Security questionnaires arrive at the worst moment — late in a sale, with a deadline — and ask a hundred questions about controls a small business may not have. How you answer matters more than most people realise, because those answers frequently become contractual warranties.

Do not overstate

An inaccurate answer that surfaces during an incident is considerably worse than an honest gap discovered during procurement. It can breach the contract, void cyber insurance where the same claims were made on the application, and destroy the relationship at precisely the worst moment. Answer what is true today, not what is intended.

"Not yet" is an acceptable answer

Most reviewers are assessing risk, not looking for perfection. "We do not currently do this; it is planned for Q3 and here is the interim mitigation" is frequently accepted, and it signals competence. A suspiciously perfect questionnaire from a ten-person company invites more scrutiny, not less.

Find out what actually blocks

Questionnaires are usually generic, applied identically to a cloud platform and a design agency. Ask the reviewer which items are mandatory for this engagement. Frequently only a handful are, and knowing which lets you address the real blockers rather than everything.

Build the answer library

After the first questionnaire, keep every answer with supporting evidence in one document. The next one is then largely copy, review, and update. Include your policies, architecture summary, subprocessor list, and any certifications — the same attachments are requested repeatedly.

What reviewers consistently care about

  • MFA coverage, particularly on administrative and remote access.
  • Where their data is stored, who can access it, and whether it is encrypted.
  • Backup and recovery capability, with evidence of testing.
  • Incident response and, critically, notification timelines to them.
  • Subprocessors — who else touches their data.
  • Offboarding: how quickly access is removed when staff leave.

Use it as a roadmap

The gaps a questionnaire exposes are usually real. If three clients in a row ask about logging and you have none, that is a genuine signal about where to invest — and it is easier to justify internally with a stalled deal attached to it.