Your customer sent a security questionnaire. Now what?

A customer just sent you a security questionnaire. Here's the short answer to "now what?": don't start on question one. Spend the first hour figuring out what the customer actually buys from you and what data you touch, find the two or three people who really know the answers, and then answer honestly, using Yes, Partial (with what you do instead) or Not yet (with a date). A truthful "not yet, here's our plan" beats a confident "yes" you can't prove, because the follow-up call is where weak answers fall apart.

The rest of this post is the step-by-step version, written for companies without a security team: the 20-person services firm, the manufacturer with one IT person, the business whose "IT department" is an MSP.

First, understand what you're looking at

Security questionnaires come in a few common shapes:

• A standard industry questionnaire. Large buyers often send a recognized template such as the Shared Assessments SIG or the Cloud Security Alliance's CAIQ. These are long because they're built to cover every kind of vendor, not because every question applies to you.
• The customer's own spreadsheet. Usually 50 to 250 rows, often assembled from several templates, with some questions asked three different ways.
• A portal. Same questions, harder to copy and paste.

Whatever the format, the buyer is trying to answer one question: if we rely on this supplier, what could go wrong with our data or our operations, and does this supplier know it?

Step 1: Scope it before you answer it (30 minutes)

Before anyone types an answer, write down three things:

1. What you deliver to this customer. A service on their site? Software they log in to? Files you process?
2. What of theirs you touch. Their data, their systems, their people's personal information, or nothing beyond email and invoices.
3. Where it lives on your side. Microsoft 365, Google Workspace, a line-of-business app, a file share, a vendor's platform.

That note decides which questions matter. If you never host their data, the data center section is mostly "not applicable, here's why." Say so plainly. "N/A" with a one-line reason is a real answer. A blank isn't.

Step 2: Find the owners, not the volunteer

Questionnaires usually land on whoever "handles compliance," which might be the office manager, the quality manager or the founder. That person shouldn't answer it alone. Pull in:

• Whoever runs IT, internal or your MSP, for access, devices, backups and patching.
• Whoever owns operations or quality, for supplier management, document control and incident handling. If you're ISO 9001 certified, your quality manager can probably answer a good chunk of the questionnaire already. We're writing up where ISO 9001 overlaps with cybersecurity and where it stops in an upcoming post.
• Whoever signs contracts, for anything that makes a promise (breach notification timelines, insurance, audit rights).

A 45-minute working session with those people beats two weeks of forwarded emails.

Step 3: Answer in three honest categories

For every question, pick one:

• Yes. You do it today and can show evidence if asked. Note where that evidence lives.
• Partial, with a compensating control. "MFA is enforced for email and remote access. Two legacy accounts are exempt and limited to one machine. We're retiring them by March."
• Not yet, with a plan. "We don't have a formal incident response plan. We're writing one now and expect it to be approved by [month]."

What you never do is check Yes because it's what you think they want to hear. Many contracts make your questionnaire answers part of the deal, and a security incident is exactly when someone rereads them.

Step 4: Inherit what your providers already prove

If you run on Microsoft 365, Google Workspace or a major cloud platform, a chunk of the physical and infrastructure questions are about your provider, not you. Microsoft, for example, publishes its audit reports and compliance documentation in the Service Trust Portal. You can say "our email and files are hosted in Microsoft 365; data center physical security is covered by Microsoft's independent audits," then focus your effort on what's actually yours: who has access, how accounts are set up, and what happens when someone leaves.

Be careful with this one. Inheriting your provider's controls covers their part. It doesn't cover how you configured it.

Step 5: Build a small security pack once

Most questionnaires end up asking for the same handful of documents. Build them once and keep them current:

• A short information security policy (two to four pages, written for your company, not downloaded).
• An incident response plan: who gets called, who decides, who tells customers.
• A list of your key vendors and what each one can access. Our one-page vendor risk questionnaire helps here.
• Evidence of the basics: MFA enforcement, backups, device management, security awareness training.
• An AI and data-use statement: which AI tools your team uses, whether customer data goes into them, and who approved that. Buyers increasingly ask, and "we're not sure" is a bad answer. More on AI tools showing up on questionnaires.

Got a security questionnaire? See your gaps first. Get your free Risk Snapshot before you start answering.

Step 6: Save every answer in a library

The second questionnaire should take half the time of the first. Keep a simple spreadsheet or document with each question, your approved answer, the evidence location, the owner and the date last reviewed. When the next one arrives, you map its questions to your library and only write new answers for what's new. MSPs answering these on behalf of many clients can use the same approach at scale; see our MSP security questionnaire playbook.

Step 7: Treat the follow-up call as the real test

Buyers who review these for a living rarely stop at the spreadsheet. Expect questions like "walk me through what happens when an employee leaves" or "show me how MFA is enforced." The companies that do well here aren't the ones with perfect answers. They're the ones where the person on the call clearly knows how the business works. This is where your "Partial" and "Not yet" answers earn trust, because you can explain the plan. We covered that gap in what buyers ask versus what compliance dashboards show.

After you hit send

Every "Not yet" is now a to-do with a customer watching. Put each one on a list with an owner and a date, and review it monthly. That list is the start of a real risk program, and it means the next questionnaire gets easier instead of just different.

Where Scarlet fits

We built Scarlet Intelligence for companies that get these questionnaires without a compliance team to answer them. Scarlet Comply helps with policies, controls and evidence, and Scarlet Governance keeps your vendor list and risk register in one place, so your answers come from what's actually true today.

Start here: Get your free Risk Snapshot and see your biggest gaps before you answer. If you'd like a second set of eyes on a specific questionnaire, grab 30 minutes with me.

Pete Macias, Founder, Scarlet Risk