Security Questionnaire Response Checklist Template

Record who asked, which questionnaire, by when and who is involved, then read it and sort the questions before anyone starts writing. Every due date counts back from the customer’s due date over 15 business days, which is this template’s choice. If the customer gave you less time, ask for more now.

• Record the request, the customer and the due date — the customer or prospect, the questionnaire as they name it, the date it arrived, the due date every task counts back from, who sent it and why, which questionnaire it is, and the response owner, deal owner, security lead, legal reviewer, technical owner and privacy lead
• Confirm how the answers must be returned and who to ask — the customer’s format (their spreadsheet, a document or their online portal), whether attachments are allowed, the contact for questions about the questionnaire, and a request for more time now if the due date cannot be met
• Identify the questionnaire and its version — the name, publisher and version or year, how many questions it has, and whether the customer changed or added to a standard questionnaire, so the right library answers and mappings are used
• Agree with the deal owner what the customer needs — the deal stage, what the customer will use the answers for (a shortlist, the contract or an annual review), and whether a call or your standard security pack would answer it sooner
• Read the questionnaire and sort the questions — each question marked as answered from the library, needs evidence, needs a subject-matter owner, does not apply, or asks the company to commit to something such as notice times, audit rights, data location or insurance
• Assign each section to an owner with an internal date — every section or group of questions given one owner and a date that leaves time for the review in Phase 6, recorded in the table

Evidence such as a SOC 2 report or a penetration test summary is confidential. Check an NDA is in place before any of it leaves the company, and agree how it will be shared. A task appears when no NDA is signed yet, when the customer will not sign one, and when answers go back through their portal.

• Check an NDA is in place with this customer — a signed NDA or a contract with confidentiality terms that covers security documents, its parties and its expiry date
• Get access to the customer’s portal and read its terms — accounts for the people answering, who is allowed to submit, what the portal’s terms say about what you upload, and how to export a copy of your answers
• Get an NDA signed before evidence is shared — the company’s standard NDA sent, or the customer’s reviewed by legal, and signed by both parties before any confidential document is shared
• Agree what can be shared without an NDA — only documents meant for general use, such as a SOC 3 report, a certificate or a published CAIQ, with the confidential evidence described in the answers instead of attached
• Agree how evidence will be shared — one route for this customer, such as a trust portal or a secure link with an access expiry date, so you know who received what and can take access away later

Start from answers the company has already approved, and check each one is still true before it goes out again. An existing customer adds a task to find what you told them last time.

• Find the answers you gave this customer last time — their last questionnaire, the evidence you sent and anything you promised, with what has changed since in your systems, suppliers or certifications
• Fill in answers from the answer library — approved answers copied in for every question they match, each with its owner and the date it was last reviewed
• Use a completed CAIQ or SIG where the questions match — if the company has already answered a standard questionnaire, its answers mapped to this one rather than written again, keeping the same wording for the same control
• Check every reused answer is still true — hosting regions, sub-processors, tools, team names, policies and certifications checked against today, with anything that changed sent to its owner in Phase 5
• Fit each reused answer to the question asked — Yes or No first where the question asks for one, then one or two sentences on how, for the service this customer buys, with no long extracts from policies

Gather the current versions of the evidence the questionnaire asks for, and check each one is in date and covers the service this customer buys. A task appears when something is out of date, out of scope or missing. Evidence can go before the answers are approved; the NDA check in Phase 2 is what protects it.

• Get the current SOC 2 report — Type 1 or Type 2, the period it covers and its end date, the services and trust services categories in scope, and the subservice organisations it leaves out
• Check the ISO/IEC 27001 certificate is in date and in scope — the 2022 edition, the expiry date, a scope statement that covers the service and sites, and a certification body you can name, checked on IAF CertSearch where it is accredited
• Get the latest penetration test summary — the testing firm, the test dates and scope, and confirmation that critical and high findings were fixed and retested; this template shares the summary or a letter from the tester, not the full report
• Gather the policies and documents the questionnaire asks for — the current approved version of each one, such as the information security, incident response, business continuity and access control policies and the sub-processor list, with its review date
• Check every piece of evidence is in date and covers the service — each document’s date, period or expiry checked against today and against the service this customer buys, with anything missing listed
• Agree what to say about out-of-date or missing evidence — a bridge letter from your management for the time since the SOC 2 period ended, the date of the next report or audit, and plain words on what the evidence does not cover
• Send the evidence through the agreed route and log it — only after the NDA check in Phase 2, through the sharing route agreed there, with each document, its version and the date it was shared recorded

The people who own each area answer what the library could not. Answer the question asked, for the service the customer buys, and say No or Partly where that is the truth. A task appears when any answer is No or Partly.

• Answer the infrastructure and application questions — hosting, encryption, network security, vulnerability management, logging and secure development, each answer describing what is in place today
• Answer the identity, access and device questions — single sign-on and multi-factor authentication, joiners and leavers, privileged access, access reviews and how staff devices are managed
• Answer the personal data questions — the personal data the service holds, where it is stored, sub-processors, the data processing agreement, retention, deletion and transfers out of the country
• Answer the incident response and continuity questions — how incidents are handled and customers told, backups and restore tests, and recovery targets, stating only what your policies or contracts already commit to
• Answer the people and supplier questions — background checks, security training, confidentiality agreements and how your own suppliers are assessed
• Mark the questions that do not apply, with a reason — a short reason for each one, such as no on-site data centre or no card data handled, rather than a blank the customer will ask about
• List every answer that is No or Partly — each question where the honest answer is No or Partly, with what is in place instead
• Agree the wording of each No or Partly answer — the control in place instead, what is planned, and a date only where the company has approved one; never a Yes to win the deal

Every answer is checked for gaps and consistency, and every answer that makes a promise is flagged. Legal reviews the flagged answers when any of them commits the company. The security lead approves the answers, and nothing after that step can be completed until a decision is recorded.

• Check every answer is complete and consistent — no blank answers, the same answer to the same question in different sections, and nothing that contradicts the SOC 2 report, the certificate scope or your published policies
• Flag every answer that makes a promise — notice times, audit rights, data location, deletion times, insurance, recovery targets and words such as always, never or within, each listed with where the promise already exists
• Legal reviews the answers that commit the company — each flagged answer checked against the contract, the data processing agreement and the policies, with answers that go further marked subject to contract or changed
• Check certifications and reports are named exactly — the full name and edition, such as ISO/IEC 27001:2022 or a SOC 2 Type 2 report for a stated period, and no claim for a service outside their scope; a SOC 2 report is an auditor’s report, not a certificate
• Security lead approves the answers for submission — Approved, Approved with changes or Not approved, based on the answers, the gaps, the commitments and the legal review

Submit in the customer’s format by the due date, keep an exact copy, and answer follow-up questions through the same review route. A task appears if the answers are not approved, and two more when follow-up questions arrive.

• Rework the answers that were not approved — the answers the security lead listed fixed, then the security lead changes the decision on the approval task once they are right, which hides this task; the deal owner and the customer are told if the due date has to move
• Submit the questionnaire in the customer’s format — by the due date, with any changes the security lead asked for made first, through the route the customer set, and the confirmation kept
• Keep a copy of exactly what was submitted — the final answers, the evidence list and the date, filed where the account team can find them, because answers can become part of the contract
• Agree the next step with the deal owner — what was sent, any answer the customer may question, and who handles the customer’s reply
• Log any follow-up questions from the customer — each question the customer’s reviewer sends back, with the answer it refers to and the date they need a reply
• Answer the follow-up questions — through the same owners, with any new commitment flagged and approved by the security lead, and legal where it commits the company
• Hold a call with the customer’s security reviewer if they ask — the response owner and the right subject-matter owner on the call, with what was said and promised written down afterwards
• Record the customer’s outcome — accepted, accepted with conditions or not accepted, and any condition or remediation the customer asked for, with its date

Put every new and corrected answer back in the library, record what you promised this customer, and close access to the evidence you shared.

• Record what you promised this customer — every commitment in the answers and follow-ups, such as a remediation date or a notice time, where the account and security teams will find it at renewal
• Add new and corrected answers to the answer library — each new answer with its owner, the date it was approved and the evidence it relies on, so the next questionnaire starts from it
• Retire answers that are no longer true — library answers found out of date during this response removed or rewritten, with their owners told
• End access to the evidence you shared — portal links, data room access and shared folders closed on the access end date agreed in Phase 2, or extended in writing
• Note what slowed this response down — questions with no library answer, evidence that was missing or late, and owners who were hard to reach, with the next review date for an existing customer