How to answer a security questionnaire well
- Answer only what's true. A wrong "yes" can breach your contract. Where you're partway there, say so and give a date.
- Be specific: name the standard (AES-256, TLS 1.2+), the frequency (quarterly access reviews) and the evidence you can share.
- Keep an answer library. Save every approved answer, and the next questionnaire takes an hour, not a week.
- Offer documents: a SOC 2 report or ISO 27001 certificate under NDA, a pen test summary, and your policies.
Questions
What is a security questionnaire?
A list of questions a customer sends before buying, to check how you protect their data. Common formats include SIG, CAIQ and custom spreadsheets.
Can I send these draft answers as they are?
No. They're templates. Replace every bracketed part with your real practice, and remove anything that isn't true for your company.
Is my data uploaded?
No. Matching happens in your browser.
Last reviewed 27 September 2026.