A customer sent us a security questionnaire, now what

The email is usually short and the attachment is not. A customer you have served for years, or one you are about to win, forwards a spreadsheet from a department you have never dealt with and asks for it back within the week. The questions run to dozens, sometimes hundreds, and are written for an organization with a security department.

Your first instinct is either to guess quickly or to stall, and neither serves you well. This guide explains why the questionnaire exists, what the customer's reviewer is checking, and how to answer in a way that satisfies the reviewer rather than prompting a second round.

Why enterprises send these

Your customer is not doubting your integrity. They are managing an exposure of their own, and the exposure is well documented.

Verizon's 2026 Data Breach Investigations Report, published in May 2026, found third-party involvement in 48 percent of breaches, an increase of 60 percent over the previous year. When a large organization is compromised through a supplier, its regulators, insurers, and customers all ask what it knew about that supplier's security. The questionnaire is that answer, prepared in advance.

The request is therefore not about you specifically. Suppliers across your customer's supply chain usually receive the same request. That changes how you should read it: as a routine process with a file to complete, not an accusation to defend against.

NIST anticipates requests like this one. In the NIST framework, a target profile describes the security outcomes an organization aims to reach. NIST notes that a target profile "can help express the organization's cybersecurity risk management requirements and expectations to suppliers, partners, and other third parties as a target for those parties to achieve" (NIST CSWP 29).

What they are checking

Questionnaires come in three broad forms. Some customers use a standardized instrument such as the Cloud Security Alliance's Consensus Assessments Initiative Questionnaire. The Cloud Controls Matrix is the Alliance's catalog of cloud security controls, and the questionnaire turns it into a set of yes and no questions. The matrix's current version, 4.1, released in January 2026, covers 207 controls across 17 security domains. Others use a proprietary spreadsheet from their own security department. Many use a shortened version of either, scaled to how much of their data you hold.

Whatever the format, the reviewer is looking for a small number of things, and the length of the document conceals how few.

Where the customer's data sits. Reviewers establish scope first. A supplier who never handles customer data is a different proposition from one who processes it daily, and a clear answer about where the data sits shortens everything that follows.

Whether an attacker can sign in as a staff member. Multi-factor authentication (MFA), unique accounts, and how access is removed when a staff member leaves. MFA is a second check at sign-in beyond the password. Reviewers weigh this subject among the most heavily, and businesses often answer it badly. The executive summary of Verizon's 2026 Data Breach Investigations Report found credentials among the data taken in 31 percent of breaches at small and medium-sized businesses. The same report found that exploited software vulnerabilities have overtaken stolen credentials as the most common way in. At small and medium-sized businesses, a vulnerability was the way in for 26 percent of breaches, and stolen or guessed credentials for 13 percent. A reviewer may therefore also ask how quickly the business applies security updates.

Recovery and notification. Backups, recovery, and above all your notification commitment. A notification commitment is the promise to tell the customer if the business suffers a breach. Many reviewers will accept a modest security posture and will not accept a supplier who might discover a breach and stay quiet.

Accountability. Whether a named person owns security, whether policies exist, and whether staff are trained. Small businesses often assume this section requires a department. It requires a name.

Consistency. Reviewers read for internal contradiction. A questionnaire claiming enforced MFA everywhere while also reporting shared administrator accounts will attract a follow-up call, which is the outcome you are trying to avoid.

Answering honestly rather than aspirationally

The temptation, and it is a strong one, is to answer as the business intends to be rather than as it is. That is the more dangerous route, and the reason is worth understanding.

A questionnaire response can be incorporated into your contract by reference, which converts an optimistic answer into a warranty you have not met. If an incident later occurs, the response is among the first documents examined, and a discrepancy between what you claimed and what was in place is a worse problem than the original gap. An honest no carries a commercial cost you can see. An inaccurate yes carries one you cannot.

Reviewers are also more accommodating than the tone of the document suggests. They assess dozens of suppliers and understand that a fifteen-person business does not run a security operations center. What reviewers want is an accurate self-description and evidence of direction.

Three practices make an honest answer persuasive.

A plain no, followed by the plan. "We do not currently have a formal incident response plan. A written plan naming responsibilities and reporting obligations is scheduled for completion in the third quarter." That is acceptable to most reviewers. A bare no is weaker, and a yes you cannot support is worse than both.

An answer at your own scale. Where a question presumes an enterprise structure, describe the equivalent control honestly. "Access reviews are performed by the managing director quarterly against a list of all accounts" is a real control. A blank field or a claimed process you do not operate are both worse.

Verification before writing. Confirm with the IT provider or the staff member who administers your systems rather than recalling. Multi-factor authentication coverage and backup testing are two questions that business owners often answer from memory, and often answer wrongly.

If the deadline is one you cannot meet honestly, say so and propose a date. Reviewers would rather receive an accurate response late than an inaccurate one on time.

Making the next one shorter

The first questionnaire is costly because you are establishing your position while under a deadline. Every one after that should take a fraction of the effort, and there is a straightforward way to arrange that.

Complete a structured assessment against a recognized framework once, on your own timetable. What you get is an inventory of your actual position across the subjects these questionnaires most often cover, written down in a form you can transcribe from. In the NIST framework, a current profile describes the security outcomes an organization is achieving now. NIST describes this use explicitly: a current profile "can be used to document and communicate the organization's cybersecurity capabilities and known opportunities for improvement with external stakeholders, such as business partners or prospective customers" (NIST CSWP 29).

The practical effect is that answering from an existing assessment becomes an afternoon's transcription rather than a week of searching for information inside the business. Your answers also stay consistent between customers. Where a reviewer asks how you know your position, you can point to a dated assessment against a published framework rather than an assurance.

An assessment also gives you something to send back. Some suppliers attach a summary of their assessment to the response, which answers several sections at once and signals that security is managed rather than improvised. That is reasonable to offer, provided you describe it accurately as a self-assessment rather than an audit or a certification. Reviewers know the difference, and claiming more than you have is the fastest way to lose their confidence.

For the fuller picture of how assessments work and when a consultant-led assessment is warranted, see the small business guide to cybersecurity assessments. If an insurer is asking similar questions at renewal, the cyber insurance questionnaire guide covers that document specifically.

Where to start

If a questionnaire has arrived, work through it honestly, answer no where no is true, and attach dates to the gaps. That is the right way to handle the current questionnaire.

For the ones that follow, the useful investment is establishing your position properly once. A self-guided assessment will take you through most of the subjects these questionnaires cover, in the vocabulary of a published framework, and leave you with a document to answer from each time a customer asks.