--- title: "Customer security questionnaire: how suppliers answer it honestly" description: "A big customer sent a security questionnaire and wants it back Friday. What it's really asking, how to answer truthfully, and how to make the next one take an afternoon." url: "https://northcreektechnology.com/guides/customer-security-questionnaire/" updated: "2026-10-13" audience: "Suppliers, owners, and CFOs" author: "Andrew Healey" publisher: "Northcreek Technology" --- # How to answer a customer security questionnaire honestly A security questionnaire from a large customer is a promise you make in writing. Answer what's true today, put a date on what isn't yet, and build an answer set you can reuse for the next one. It usually arrives the same way. A large customer's vendor risk team sends a spreadsheet or a portal link with 100 to 300 questions and a deadline. Someone forwards it to the IT company. The IT company sends back half the answers. The rest lands on the controller or the office manager, who spends a weekend searching what the terms mean. In Northwest Arkansas this happens a lot, because many local businesses supply the large retailers, consumer-goods companies, and logistics firms headquartered here. Their vendor risk teams send these to many of the suppliers that touch their data, their systems, or their supply chain. ## What it's really asking The questions vary, but most are built on a few common frameworks: the SIG questionnaire from Shared Assessments, the Cloud Security Alliance's CAIQ for software and cloud vendors, or the NIST Cybersecurity Framework. Under all of them sit the same handful of questions: - **Who's in charge?** Is there a named person responsible for security, and a written program, even a short one? - **Who can get in?** Do you use multi-factor sign-in (MFA, a code or prompt on your phone at login), remove access when people leave, and control what vendors can reach? - **Can you recover?** Do you have backups that work, and have you tested a restore? - **Would you know?** Is anyone watching for attacks, and do you have a written plan for what happens if one succeeds? - **What about our data?** Where does the customer's data live, who can see it, and is it encrypted? - **Who else is involved?** Which of your own vendors touch the customer's data? ## How to answer **Read the whole thing before answering any of it.** Sort the questions into three piles: true today, partly true, and not in place. That sort takes an hour and tells you how big the job is. **Answer the question asked.** If it asks whether MFA is on for all users and it's on for most, the answer is no, with a note: "On for all office staff. Two shared plant accounts are scheduled for April 30." **Never write yes to get to the next question.** Your answers can end up attached to your supplier agreement, and the customer may check them later. A false yes can turn into a contract problem later. **Give a date for every gap.** "Not in place, planned for Q2" is a real answer. "In progress" with no date isn't. **Attach proof only when they ask for it.** Policies, a short summary, or a certificate of insurance. Don't send network diagrams or internal reports unless the customer asks and you're comfortable with where they'll go. **Ask for more time if you need it.** Ask early, say why, and give a date. ## Make the next one take an afternoon The first questionnaire is the hard one. Keep every answer, with its proof and the date you last checked it, in one place. That becomes your answer set. When the next one arrives, most of the work is copying and checking that nothing changed. Review the set when something big changes: a new IT company, a new system, a security incident. Many of the same questions appear on your [cyber insurance application](/guides/cyber-insurance-application/). Check both against the same proof so they never disagree. ## Who should own it Someone has to own these answers year after year: keep them true, keep the proof current, and talk to the customer's security team when they call. In a large company, that's a security officer. In a growing one, it's often nobody, which is how the questionnaire ends up on the controller's desk. That ongoing job is part of what our part-time technology and security leader does. ## Questions ### Can we ask for more time? Yes. Ask early and give a date. Customers would rather have accurate answers a week late than fast answers that turn out to be wrong. ### Will a "no" cost us the account? Not usually by itself. Large customers expect smaller suppliers to have gaps. What worries them is a supplier who can't explain its answers or doesn't know what's true. A "no" with a short plan and a date reads as a supplier who has it under control. ### Should our IT company fill it out? They should supply the technical facts. They shouldn't sign it or decide how to answer. Some questions are about your policies, your people, and your contracts, and the company owns those answers. ### Do we need a SOC 2 report? Only if your customers keep asking for one, and usually only if you hold or process their data in your own systems. It's a formal audit by a CPA firm and takes months. For most suppliers, a clean, honest answer set and a short security summary are enough. ## Related guides - [Is your cyber insurance application true?](https://northcreektechnology.com/guides/cyber-insurance-application.md) - [An AI policy your staff will actually follow](https://northcreektechnology.com/guides/ai-policy-for-employees.md) - [How to tell if your IT company is doing a good job](https://northcreektechnology.com/guides/evaluate-your-it-company.md) ## Where Northcreek Technology fits Fractional Technology Leadership (Fractional CIO and part-time IT director): Someone who owns your technology, your IT company or team, and the risk, on a monthly retainer. The role most growing businesses never got around to filling. https://northcreektechnology.com/services/fractional-technology-leader/ ## Next step Book a call: https://northcreektechnology.com/contact/