Security questionnaire preparation
Gather the documents behind your security answers.
Use this checklist to inventory what you already have, identify open questions, and prepare for a response review. You do not need a complete document set to ask about fit.
Need answers drafted? Request a quote
Last reviewed: .
See the Security Questionnaire Response service and pricing
Start with the request
- Keep the questionnaire and the buyer’s instructions together.
- Note the deadline and approximate question count. Mark anything you are unsure about.
- Identify who can confirm your current operations and approve final answers.
Make a document inventory
For each document or report you already have, note its title, version or date, owner, relevant section, and what still needs confirmation. Do not create a claim simply to fill a gap.
- Security policies and procedures referenced by the questions
- Access-control and data-handling documentation, where available
- Existing testing or assurance reports, if a question asks about them
- Any unanswered questions for the people responsible for the systems
A fictional inventory. Not client work.
| Document | Reference | What to confirm |
|---|---|---|
| Fictional Access Control Standard | Section 3.1, version 2 | Whether the MFA requirement covers every current administrative account and exception |
| Penetration-test report | None supplied | Whether testing was performed and whether a report is available |
Separate evidence from operational truth
A written policy can support a draft, but it does not prove the policy is implemented. Ask the responsible person to confirm the current environment and exceptions.
A missing report does not mean testing never happened. Mark the evidence gap and ask for confirmation. Leave a yes/no answer open until it is supported.
Review before sending
- Check that each draft matches the question and cites the correct document section.
- Resolve open questions with the responsible people.
- Approve the final answers before you send them. You remain responsible for those answers.
Response preparation does not provide a certification, audit, penetration test, or independent verification of your controls.
Ask about the work without sending files
For an inquiry, share the approximate question count, deadline if known, and whether you have supporting documents. Leave out files and sensitive details. Scope, timing, and price are confirmed before payment.