How to answer a client security questionnaire without a security or IT team

The practical reality of IT compliance

Imagine this (not so theoretical) scenario: A client just sent you a supplier security questionnaire: a spreadsheet of questions about your company’s password controls, backup configurations, data protection measures and incident handling processes. The questionnaire they sent your company is part of your client’s third party risk assessment process, and it usually means the deal is moving forward. Your client has asked you to respond to the questions as soon as possible. The problem? You have no security team or anyone who understands technical details in depth. That’s quite normal for a small business like yours, and the request’s sender knows it.

There is, however, one more important limitation to consider: you have near-zero visibility on your IT controls and practices. Sure, you are using your tools to enable your business; however, you lack the deeper insight that will help you identify issues, analyze problems and highlight which controls apply in your infrastructure. Not necessarily because you lack the knowledge or willingness to grasp the nuances, but because you don’t know where to look or how to structure your approach. Sounds familiar?

The above scenario is not uncommon for small and medium-sized companies that process any data as part of their daily operations. Chances are, if your company uses tools and applications to store, process or share information, you too will sooner or later receive such a request from a client of yours. If you haven’t gotten one already, that is. The limitations are also very real: you have limited time or technical knowledge to approach this topic with confidence. Perhaps there are systems that were set up by a former colleague and the knowledge left with him. Meanwhile, your client is waiting for a response to an inquiry that will potentially define their future collaboration with you.

How to answer IT questions – the right way!

1. Organize your scope

Responding to inquiries similar to the one mentioned above does not have to be complicated. Following a structured and strategic approach is, more often than not, what it takes to address requests gauging your company’s IT maturity with confidence. This is possible regardless of whether you have all the technical answers. Below you will find the best way to approach this seemingly complicated situation.

A good first step is to sort the questions you received (especially when you answer a security questionnaire without a security team or IT department) into three groups:

• Questions you can answer yourself: these could be questions around general security measures, HR contracts, the presence of cyber insurance or GDPR notices;
• Questions that are too technical: questions around multi-factor authentication (MFA), encryption or backups might be a bit too demanding for you. Send those to your IT provider or look the answers up in any public documentation they may be providing;
• Everything else should be marked as “No information yet” or something similar, to indicate you need more time and input to answer those. Oftentimes clients can be flexible if 4 or 5 questions are still missing an answer. A good idea is to negotiate a deadline with them to gain some time.

2. The right way to answer IT questions

From our personal experience, there is a right way to answer client inquiries, all centered around simplicity, comprehension and accuracy. The key is answering what you actually do, in plain words. If you’re wondering how to answer a question on privileged access processes: it is asking who has admin rights and how they log in. You don’t need to go into a huge amount of detail, but try to be specific and to the point. An ideal answer would be, for example: “Two people have admin access, both use MFA, and we review access every quarter.”

If the questionnaire only requires you to answer yes or no, things are a bit easier. An honest “no” to a question around monthly patching is acceptable when you add what you do to keep your systems secure and a different timeline to fix it. Similarly, a “yes” you can’t substantiate is a real risk, because questionnaire answers can end up in the contract with the client, or be used when an incident takes place despite claiming the control was present. This is why strategic directness and accuracy are so important.

A few more insights you will not find anywhere else:

• Don’t misrepresent your company. If your company hasn’t gone through a successful ISO27001 audit, don’t fake it till you make it by using an Amazon, Google or Microsoft (depending on which one you use) ISO27001 certificate as your own. It’s best to admit you don’t do everything perfectly and that you’re working on it, as opposed to claiming perfection. The truth will, ultimately, be revealed, and it won’t be in your favor.
• Take data confidentiality into account. Sometimes oversharing can actually hurt you. If you are given an open text field to type an answer away, step back and think “What is the question asking me, and how much information would be enough to satisfy the client? Can I provide slightly less than that and get away with it?” Sometimes, less is more, especially if confidential data (such as the sharing of screenshots of your systems, contract details with your subprocessors, or a list of your company’s employee names) are involved. If the information is confidential to your company, or if it seems unnecessary for your client to assess your IT maturity, challenge them and do not immediately provide everything they ask, as difficult as it sounds to go against them. Be vigilant when it comes to sharing policies, procedures and other attachments as well!

3. Reuse the input

You may have responded to a set of questions or inquiries by client A, but client B could very well send you a very similar questionnaire to fill in. It is, therefore, beneficial to build a library of reusable security questionnaire answers, sorted by topic, that can be reused when such inquiries come your way. You can also link your security policies and evidence for reuse (taking into account what we warned about in the previous section!). Most vendor security questionnaires and IT inquiries cover similar ground each time: access, devices, backups, incident response and data protection (to name only a few). This is why having a single source of information can be so beneficial and time-saving!

Of course, it is still up to you to periodically review your library (we recommend you do this at least once a year). Data accuracy is important, so an up-to-date database is crucial. This way you can always be ready to reply to such generic inquiries effortlessly. And remember, with regulatory mandates such as the NIS2 supply chain requirements pushing more companies to evaluate their suppliers, the next customer security questionnaire will likely come soon.

How EvRisko can help you address client inquiries

The above best practice steps are essential in addressing client information security questions and IT requests in an easy and fast way. Following those will guarantee you have a structured way of dealing with such requests, in a way that can help you maintain good relationships with your clients, attract more business and build trust that your products and services are secure!

Do you want to know where your IT risk stands before the next client questionnaire arrives? EvRisko, similar to your clients, asks plain-language questions about your IT infrastructure and controls and gives you a risk score, along with a list of what to fix first. You can use this output to gain more confidence around where your IT maturity stands, and lose less time answering tedious client requests when they come your way! The exportable PDF report can also be used to gain clarity and confidence. Try EvRisko now!

Frequently asked questions