Security Questionnaire Response Toolkit — Guide

Security Questionnaire Response Toolkit

A questionnaire answer is a statement the organisation is held to. A customer reads it as a description of what the organisation does, relies on it when it decides to buy, and may point to it later if something goes wrong. So the organisation answers once, from an approved source, with evidence behind it, and says what the answer covers. A form is not the place to agree a new commitment. Promises are made in the contract, through a standard schedule and a short ladder of approvals, and an answer never promises what the contract or the controls do not support. The result is counts of requests answered on time, answers reused, evidence in date and commitments kept. It is never one score.

Is this for you?

This pack is for you if:

• you are an IT or security manager at a supplier, a 300-question form has just arrived with a deadline, and the people who know the answers are busy;
• sales keeps asking for “the security answers” and you are not sure who has said what to whom;
• you have found that two customers received different answers to the same question;
• a customer has asked for a certificate you do not hold, or for a right to audit, or for a notice period, and you need to know who may agree;
• you want a form to take hours of work rather than weeks, and want to know that none of it will come back as a broken promise.

What is different about answering a questionnaire

A questionnaire looks like paperwork. It is not. A customer reads each answer as a description of what you do, relies on it when it decides to buy, and may point to it later. Six things follow.

• An answer is a statement you are held to. The person who types “Yes” is speaking for the organisation. Decide who may type it (QG-01, QG-02).
• The same question needs the same answer. Two customers who compare notes should find no difference. Keep one approved answer for each standard question and use it unchanged (QG-05).
• Say what the answer covers. “Yes” for the online ordering service is not “Yes” for the company. Every answer carries one scope of claim (QG-07).
• Show the evidence or say there is none. An answer that states a control, a test or an assurance cites a document from your index, or says it is a statement only (QG-06).
• A form is not a contract. A date, an action, an absolute word, a right of audit or a liability in a form can read as a promise. Promises belong in the contract, through a standard schedule (QG-09).
• A wrong answer is yours to correct. Withdraw it, find every response that used it, and tell the customer (QG-19).

P06 covers the questionnaires your organisation sends to its suppliers. This pack covers the ones it receives from its customers and answers as a supplier. P06’s tiers, clause library and evidence checklist show what a customer that follows the same model will probably ask for. This pack does not change them.

Why customers ask, and what binds you

Customers ask because the law and good practice ask them to manage their suppliers. What binds them does not bind you in the same way. Counsel confirms how it applies to you.

NIS2. Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 21(2)(d) and 21(3) ask a customer that is such an entity to manage the security of its direct suppliers and service providers, and to take into account the quality of their cybersecurity practices. They bind the customer. They do not give it a right to an answer from you. ENISA’s guidance for hospitals says the Directive does not directly impose requirements on ICT suppliers and that its obligations take effect through national law. A questionnaire is the customer’s way of meeting its own duty, and what you owe it comes from your contract. A supplier that is itself an essential or important entity has its own Article 21 duties, which this pack does not restate.

DORA. Regulation (EU) 2022/2554 binds the financial entities of its Article 2. Articles 28 to 30 say what a financial entity does about ICT third-party risk and what its contract with an ICT third-party service provider holds. A provider is bound to them through that contract. Article 30(3) asks for more where the service supports a critical or important function of the financial entity. A customer that is not a financial entity cannot rely on Article 30 to ask the same of you. Counsel confirms whether a customer is a financial entity and whether a service supports a critical or important function of it.

The forms you will meet

Customers use their own forms or a standard one. The pack reads each as its publisher states it.

• The CSA CAIQ and CCM. The Cloud Security Alliance describes its Cloud Controls Matrix as 197 control objectives in 17 domains. The CAIQ, built into the matrix, is a set of yes-or-no questions for assessing cloud providers.
• CSA STAR. A public registry that a supplier can publish to. CSA says publishing to it can help reduce the number of customer questionnaires. Its levels, and the lifetime of a listing, are as CSA states them.
• The Shared Assessments SIG. A licensed questionnaire standard that, on its publisher’s page, measures security risk across 21 risk domains, one of which is Artificial Intelligence. A customer may choose a Lite or a Core level.
• SOC 2 reports and ISO/IEC 27001 certificates. Evidence that a customer may ask for, cited here by name and number only. A report covers the organisation and the period it names, and a certificate covers its stated scope. The pack states no criterion of either.

None of these makes a customer entitled to an answer, and a certificate is not a way to avoid reading a customer’s questions. It is a way to answer many of them from one document.

The sources and their editions

The pack reads NIS2 (Directive (EU) 2022/2555), DORA (Regulation (EU) 2022/2554) and the GDPR (Regulation (EU) 2016/679) as published and read on 9 October 2026. ENISA’s guidance for hospitals (July 2026), the UK NCSC’s supply chain principles, the CSA CCM, CAIQ and STAR, the Shared Assessments SIG and AICPA SOC 2 are guidance or industry practice, not law. ISO/IEC 27001 is cited by number and title only. A proposal to amend NIS2 was published on 20 January 2026 and was not found adopted. We did not read the CSA spreadsheets, the SIG questions, the SOC 2 criteria or any national text.

The three decisions at the door

Every request is triaged within 2 working days of receipt (a house default you set yourself). The response lead decides one of three things and records the reason.

Before any drafting, look for a response to the same customer or the same standard form. Count, as numbers, how many questions have a Current library answer, how many a stale one and how many none. Those three counts decide the work.

Who may approve what

The approver follows the kind of answer. Nobody approves an answer they wrote: the next level takes their place (QG-08).

The account owner manages the relationship and sends only what the response lead has released. The account owner writes no security answer (QG-02). A drafting tool, including an AI assistant, may suggest an answer from the library if it is approved for the data it sees under P24, and its draft takes the same approval (QG-22). A customer’s questionnaire is Confidential, and an answer about AI comes from the AI inventory and the reviews behind it (P24, P25), confirmed by the AI governance lead (QG-20).

The answer library

The library holds one answer for each standard question, grouped under ten topics: Governance, Access, Data protection, Incident notice, Resilience, Development, Suppliers, AI, Privacy, Physical. Each answer has an owner, one scope of claim, the evidence behind it and a review date. The scopes are: CS-1 whole company; CS-2 named service; CS-3 named site; CS-4 named system or tool list; CS-5 supplier’s service, not ours; CS-6 written policy only; CS-7 plan with a date.

An answer is Current only if it is approved, its evidence is in date and its review date has not passed. A stale answer is not sent until its owner has confirmed or changed it (QG-12). Incident notice and AI answers go out of date sooner than the rest.

Evidence, and who may see it

The index lists every item you can show: certificates, audit reports, test summaries, policy extracts, diagrams, insurance certificates and attestation letters. Each item has a sharing tier. Evidence past its expiry is not sent (QG-13).

A document that belongs to a supplier, such as your hosting provider’s certificate, is shared only as that supplier’s terms allow and is described as the supplier’s. It is never shown as your own (QG-14).

Catching the answer that promises too much

A form invites claims that you cannot stand behind. The checklist reads every answer for eight kinds of flag. A flag does not say the answer is wrong. It says the answer needs a different approver before it goes out, and that approver clears the flag in writing (QG-11).

Promises belong in the schedule

When a customer wants a commitment, offer the standard schedule. It holds ten commitments: security measures, security incident notice, assurance and audit, sub-processors and subcontractors, return and deletion of data, confidentiality, security testing, continuity and recovery, assistance with your obligations, notice of material change. Each has standard wording, a pre-approved fallback and a statement of what lies beyond it. The schedule states no notice period of its own. For an incident, it points to the rules of the incident management pack (P09) and the regulatory notification pack (P18), which own the clocks. The return and deletion periods are the same timing that P06 asks of your own suppliers.

A negotiation climbs a short ladder.

Alternative wording needs Legal and the Head of Information Security. An exception is a departure from the standard. Rate the risk it leaves on the bands of the risk assessment pack (P05) and take it through the exceptions process (P02). Legal and the approvers the band sets decide, and nobody approves an exception for a risk they own.

When an answer turns out to be wrong

Withdraw it from the library at once. Find every response that used it. The topic owner states the correct answer. Then rate the error minor or material. An unsupported commitment or an overstated scope is always material, and so is any error the customer relied on or that sits in the contract. A material correction is approved by Legal and the Head of Information Security and reaches the customer within 5 working days of the error being confirmed (a house default you set yourself). Where the error shows a control that does not work, or exposes personal data, report it as an event through the incident route (P09 IM-01). The correction is logged, and nobody is blamed for a report made in good faith.

The order to work in

The document numbers are not the order of use. Do steps 1 and 2 once, then build the library and the index from the forms you have already answered. From then on, steps 5 to 8 happen for each request.

Start with Questionnaire Response Governance Method, Questionnaire Intake, Drafting & Approval Procedure and Evidence & Attestation Library Index. The index is the quickest way to find what you cannot send today.

How it runs in practice (EXAMPLE)

Take the distributor of the earlier packs: about 900 staff, three warehouses and an online ordering service. It sells to business customers: retailers, a hospital group and a regional public body. It is an important entity under NIS2. The Questionnaire response lead owns the method, and nobody approves a document they own (P04 PF-03), so the Head of Information Security approves it at P04’s Standard tier. It approved the method on 25 Aug 2026. The distributor holds no ISO/IEC 27001 certificate of its own. Its hosting provider holds one for the hosting service. P08’s example is a different company, a software firm working towards its first certificate.

Its library has 50 answers: 28 Current, 3 Review due, 3 Evidence expiring, 6 Stale, 9 Draft, 1 Withdrawn; 34 can be sent as they stand. The 6 stale answers wait for their owners, and the 9 drafts have placeholders to fill.

• The hospital group’s form. On 14 September 2026 the hospital group sent its own form of 300 questions, to be answered in its own portal. At triage, 198 questions had a Current library answer, 42 a stale one and 60 none. The first group is released by the the Questionnaire response lead. The second is confirmed by its topic owners. The third needs the Head of Information Security to approve each answer. A form above 60 questions is offered the overview and the evidence first, and this customer wanted the form answered in full.
• Drafts that the checklist stopped. Early drafts of the hospital group’s answers held these. Each went back to its owner, and a library answer or the schedule took its place.

• Evidence for the hospital group. The group’s non-disclosure agreement is with its lawyers, so none covers the recipient today. Of the 9 evidence items, 2 may go as they stand (EI-01 and EI-04). The penetration test report stays inside and its summary (EI-03) needs the agreement. One item, the hosting provider’s certificate, expires on 14 Nov 2026 and is the provider’s, not the distributor’s. The distributor says so, and says when it expires.
• Two promises found and corrected. A review of old answers found CM-01: “We test all systems every six months.”, in a form of 20 Nov 2025, and CM-02: “We tell all customers of any security incident.”, in a form of 17 Feb 2026. The contract supported neither. Both were withdrawn, corrected with the customers and logged as Corrected.

On 30 September 2026 the leadership team saw five counts.

Read this as the distributor’s own record. It does not say that the distributor, or any of its answers, meets any standard or law.

Your first month

What to report

Report the five measures (QM-01 to QM-05) every month as counts. Never combine them into a percentage, a score or a traffic-light total. Show the open commitments by name, and those past their due date first.

Everything in the pack

Limits

• Not legal advice. This document helps you answer security questionnaires from your customers. It is not legal advice, and an answer, a certificate or a schedule from this pack is not a statement that you comply with NIS2, DORA, the GDPR or any standard. A response is a statement your organisation is held to. Ask counsel to confirm any answer that a customer could treat as a promise or as a legal claim, and whether a customer is a financial entity or an essential or important entity.
• No mapping. A reference says what its source asks of the customer or the provider, and which CISO Times document helps with that work. It does not say that an answer, a certificate or a schedule from this pack meets a requirement of NIS2, DORA or the GDPR.
• Other packs own the rest. Supplier assurance, the questionnaires you send, is P06’s. The incident management pack (P09) owns the response and the regulatory notification pack (P18) the duties and clocks. This pack states no clock. P24 and P25 own AI governance and security, P02 exceptions and P05 the risk scales.
• A response is a snapshot. It describes the organisation on the day it was written, for the scope each answer states.
• The files are yours. Every file in the pack stays on your own systems. Nothing you enter in them goes back to the CISO Times.
• The example is not a real firm. The distributor is fictional, marked EXAMPLE, and every value in it is made up.

Where it maps

• NIS2, Directive (EU) 2022/2555: Articles 21(2)(d) and 21(3), the customer’s side. DORA, Regulation (EU) 2022/2554: Articles 30(2) and 30(3), the provider’s side. GDPR: Articles 28(3) and 32(1).
• ENISA, procurement guidelines for hospitals and healthcare providers (July 2026); UK NCSC supply chain security guidance, principle 5; CSA CCM, CAIQ and STAR; Shared Assessments SIG; AICPA SOC 2, by name and title only; NIST CSF 2.0: GV.OC-02.
• ISO/IEC 27001:2022: Clause 4.2, Understanding the needs and expectations of interested parties. By number and title only. ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, DORA or the GDPR, or that your organisation holds a certificate.