Customer security questionnaire: template and example answers

This is a general preparation tool. Use your customer's required form when they provide one, and check which questions apply to the service.

What is included?

• Questionnaire: 22 questions with space for your answer, evidence, owner, checked date and follow-up.
• Worked examples: Five fictional responses showing Yes, Partly, No, Not applicable and To check.
• Evidence checklist: Possible supporting documents, with space to record what you have and how it can be shared.

How to use the questionnaire

1. Name the service, systems and information your answers cover.
2. Choose Yes, Partly, No, Not applicable or To check. Explain the scope of each answer. Leave a question as To check until the right person has confirmed it.
3. Record an evidence reference, the person who checked the answer and the date. Explain gaps and agree any follow-up with the customer.
4. Check which evidence can be shared and how. Keep sensitive reports in an agreed secure location, and use references in the workbook.
5. Before sending, remove the fictional examples and internal notes from the copy you share. Review the answers again when the service or evidence changes.

Read the full guide to answering customer security questionnaires

Example answers

All example answers, dates and evidence names are fictional. They show how to explain an answer, including an unresolved gap. Replace them with your own checked information.

Questions in the workbook

• Q01. Is someone named to oversee security for this service? Name the role and how a customer reaches the right person.
• Q02. Are security policies in use for the work covered by this response? Name the relevant policies, their review dates and how staff follow them.
• Q03. Do staff receive security training relevant to their work? Explain who is covered, how training is recorded and any gaps.
• Q04. Do you keep a record of the devices used to deliver the service? Explain what the record covers and who keeps it current.
• Q05. Is access limited to what each person needs for their work? Cover privileged access and changes when people join, move or leave.
• Q06. Do you check a user's identity before allowing remote access? Describe the checks used and any exceptions.
• Q07. If you configure cloud systems for the customer, do you check their security settings? Name the systems you manage. Explain if this work is outside your service.
• Q08. Are company laptops that hold customer information encrypted? State which devices are covered and how exceptions are handled.
• Q09. Is customer information protected when sent between systems? Describe the methods used and any unprotected routes still being checked.
• Q10. Have you checked where customer information is stored, processed and accessed? Include support and development access. Record anything awaiting confirmation.
• Q11. Is there a plan for handling a security incident affecting this service? Identify the owner, escalation route and how the plan is reviewed.
• Q12. Have incident reporting arrangements been agreed with the customer? Record the contact route and agreed timescales. Check the customer's contract.
• Q13. Are backup and recovery arrangements defined for this service? Describe the information covered, responsibilities and any service exclusions.
• Q14. Have you tested restoring the information needed to provide this service? Give the last test date, what was tested, the result and any unresolved gaps.
• Q15. Do you manage security updates for systems used in this service? Describe the process and how outstanding updates are tracked.
• Q16. Has relevant independent security testing been carried out? State the scope and date. Record who owns any unresolved findings.
• Q17. Is physical access to customer information and equipment controlled? Cover relevant premises, visitors and disposal of sensitive printed information.
• Q18. Are relevant security requirements passed to subcontractors? Name the services they provide and explain how changes are checked.
• Q19. Do you hold a current security certification covering this service? Name the certificate, issuer, scope and expiry if held. Record No if none is held.
• Q20. Are arrangements agreed for returning or deleting customer information? Explain what happens at the end of the service, including copies and backups.
• Q21. Are these answers reviewed when the service or supporting evidence changes? Name the owner and the changes that trigger a review.
• Q22. Has the evidence intended for the customer been checked before sharing? Confirm permission, any redactions, intended recipients and the agreed sharing method.

The question topics draw on the following guidance. The workbook and fictional examples are authored by The Assurance Desk.

This is an independent editorial guide, not legal advice.