How to Answer a Customer IT Security Questionnaire
A larger customer has sent you a spreadsheet of security questions, and it needs to go back by Friday. This guide explains what these questionnaires are looking for, how to work through one without panicking, and how to answer honestly when something isn't in place yet. It's written for small UK businesses, typically 1–50 staff.
Why Customers Send Security Questionnaires
When a business shares data with a supplier, or lets a supplier into its systems, the supplier's security becomes part of its own. A weakness at a small supplier can be the way in for an attacker. That's why larger organisations are encouraged to check their suppliers. The NCSC publishes supply chain security guidance and a list of supplier assurance questions for exactly this purpose.
So a questionnaire isn't an accusation. It's your customer doing its own homework. What it wants is confidence that you understand the basics, that someone owns security, and that your answers are true.
What They Usually Ask About
Every customer's format is different, from a 20-line email to a several-hundred-row spreadsheet, but the topics repeat. The NCSC's supplier assurance questions are grouped into areas like these, and many buyer questionnaires follow a similar pattern:
- Security governance: who is responsible for security, and whether you have policies that staff can see.
- Incidents: whether you have a plan to deal with and recover from an incident, and whether you've had any significant breaches.
- Protecting your network and accounts: firewalls, updates, anti-malware, who has admin access, MFA, and how personal devices are handled.
- Protecting data: encryption on laptops and phones, secure disposal of old devices, and how data is protected in transit.
- Where data goes: whether any of your service or data storage is outside the UK, and which suppliers you rely on.
- Personal data: how you meet UK GDPR principles for any personal data you handle for them.
- People: security awareness training, and how staff report problems.
- Certifications and testing: whether you hold Cyber Essentials, Cyber Essentials Plus or ISO 27001, and what they cover.
Increasingly you'll also see questions about backups (including a copy kept offline), business continuity, and the use of AI tools.
Before You Start: Read It All and Triage
Resist the urge to start at row one. Spend 20 minutes reading the whole thing and noting:
- The deadline, and whether you can realistically meet it. If not, ask for more time early. Most customers would rather wait than receive guesses.
- Who knows the answers. Some will need your IT provider. If they manage things like backups or patching for you, ask them to confirm in writing what they do.
- What you're asked to attach, such as policies, certificates or an insurance summary.
- Anything you don't understand. It's fine to ask the customer what a question means. A clarifying question is better than a confident wrong answer.
A Simple Step-by-Step Approach
- Group the questions by topic. Access, devices, backups, incidents, data, suppliers, people. You'll quickly see that many questions ask the same thing in different words.
- Answer from reality. For each question, write what you actually do today. Be specific: "MFA is enforced on all Microsoft 365 accounts" is stronger than "we take security seriously".
- Point to evidence. If a policy, register or certificate backs up the answer, reference it. That's often what reviewers look for.
- Mark the gaps honestly (see the next section).
- Check for consistency. Read the answers through in one sitting. A "yes" on row 12 and a contradicting answer on row 80 undermines trust more than an honest gap.
- Get sign-off. A director or owner should read and approve the answers. They're statements your business is making to a customer.
- Keep a copy. Save exactly what you sent, with the date. You may be asked again at renewal, or held to it later.
How to Answer When Something Isn't in Place Yet
This is where small businesses most often go wrong: answering "yes" because "no" feels like it will lose the contract. Don't. If your answers turn out to be untrue, that can cause far bigger problems with the customer later than an honest gap would now.
A good partial answer has three parts: what you do now, what you're putting in place, and when. For example (illustrative wording only):
- "We don't currently hold Cyber Essentials. We are working through the requirements and plan to apply by March 2027."
- "MFA is enforced on email and our accounting system. We are enabling it on our remaining cloud services this month."
- "Backups run daily to a cloud service. We have not yet tested a full restore and have scheduled one for next month."
Only commit to dates you can meet, and then do the work. The customer may come back and check.
Documents You May Be Asked to Attach
Requests vary, but these come up often:
- an information security policy (the most common request)
- acceptable use, access control, and data protection handling policies
- an incident response plan
- a backup and business continuity summary
- your Cyber Essentials certificate, if you have one
- a list of key suppliers or sub-processors that handle the customer's data
Only send what's asked for, check each document is current and approved, and don't send anything containing passwords, system details an attacker could use, or other customers' information.
Common Mistakes to Avoid
- Copying answers from the internet or another company. They won't match your setup, and reviewers can tell.
- Overstating controls to look stronger. An honest "no, planned for March" reads as more mature than a "yes" you can't back up.
- Vague reassurance such as "industry-standard security". Say what you actually do.
- Leaving questions blank. If something doesn't apply, write "Not applicable" and a few words saying why.
- Letting it drift. Answers that were true last year might not be true now.
Making the Next One Easier
Once you've answered one questionnaire, you've done most of the work for the next. Keep your approved answers in one place, an "answer bank", with a note of which policy or record supports each one. Review it when something changes, such as a new system or a new IT provider. Next time, most of the job becomes checking and adapting rather than starting from scratch.
If you don't have written policies yet, questionnaires are a strong reason to write them. Many questions are really asking, "Is this written down and owned?"
Where to Get Help
If a question is technical, your IT provider should be able to help. For a quick, honest view of where you stand first, our free readiness checklist takes about 15 minutes and shows which policy covers each gap.
Common Questions
Can We Refuse to Answer Some Questions?
You can, but explain why. Some questions ask for information that could help an attacker, such as detailed network diagrams. It's reasonable to offer a summary instead, or to share details only under a confidentiality agreement.
What If the Customer Asks for a Certification We Don't Have?
Say so plainly, and explain what you do have in place. If the requirement is firm, ask whether a dated plan to achieve it would be acceptable for now. Don't imply you hold a certificate you don't. Cyber Essentials certificates can be checked on IASME's public certificate search, which the NCSC overview page links to.
Can We Reuse Last Year's Answers?
Yes, as a starting point. Check every answer is still true before you send it. Systems, suppliers and staff change, and an answer that was accurate a year ago may not be now.
Sources
Official guidance referred to in this guide (checked 18 October 2026):
- NCSC: Supply chain security guidance
- NCSC: Supplier assurance questions
- NCSC: Cyber Essentials overview