1 · Clarify the request
Identify the service, legal entity, deadline and customer expectations. Confirm which systems and suppliers are relevant.
A customer sent a security questionnaire. Where do you start?
Practical guide · Milica Vlk · 22 September 2026
A questionnaire is a request for evidence about your organization. A useful response starts with scope and ownership before anyone begins filling in answers.
2 · Assign contributors
Name a response owner. Involve the people who know the controls, contracts, infrastructure and privacy obligations.
3 · Gather supporting evidence
Link each answer to a current policy, configuration, record or accountable owner. A planned control should not be described as implemented.
4 · Record gaps honestly
Separate implemented, partially implemented and planned controls. Explain limitations and agree a response where the question does not fit.
5 · Review before sending
Have authorized owners approve the answers. Share only appropriate evidence through the agreed channel; redact confidential material.
6 · Keep the follow-up useful
Track outstanding actions and owners. Reuse validated evidence, but review it before answering the next customer.
A useful distinction
A policy describes an expectation. A configuration or operating record helps demonstrate what happens in practice. Neither should be used to imply more assurance than the evidence supports.
This guide is general information. The customer request and contractual context determine the appropriate response.
Discuss a customer request