Your first security questionnaire: a five-day plan

A customer you want to sign has sent a spreadsheet. It has a tab of instructions, a hundred-odd questions about how you protect their data, and a due date in the email. Nobody at your company has filled one in before, and there is no security team to hand it to.

This is a plan for answering it in five working days. It assumes one person owns the job (probably you) and that the facts are spread across a few people. If your deadline is shorter, keep the order and shorten the days. One thing a plan cannot do: no plan, this one included, decides whether your customer approves you. What it can do is get honest, consistent answers to them on time.

Why you got one

A questionnaire is due diligence, not an accusation. NIST’s Cybersecurity Framework 2.0, a public framework from the U.S. National Institute of Standards and Technology, asks an organization to do “planning and due diligence” before it enters a supplier relationship (GV.SC-06), and to keep assessing and monitoring a supplier’s risks “over the course of the relationship” (GV.SC-07). NIST SP 800-53, the federal control catalog, has a control for the same job: assess and review the supply chain risks of suppliers, as often as the organization decides (SR-6).

Your customer may follow neither document. The logic is the same either way, and two things follow from it. Being asked says nothing bad about you. And it will come back: from this customer again at some point, and from the next one before the deal. So the plan below ends with a file you keep.

Day 1: read it, scope it, ask

Do not answer anything today. Find out what you are answering.

• Name it. Is it a SIG Lite, a CAIQ-Lite, or the customer’s own sheet? Our guide to SIG Lite and CAIQ-Lite covers what each one asks and how long they run.
• Count it. Count the real questions, not the section headings. Note the answer format: a Yes / No dropdown, a comment column, a place to attach documents.
• Read the instructions tab and your contract. Your answers are statements of fact to a customer, and they may end up part of the deal. Our guide to answering when you don’t have the control explains why that matters.
• Name an owner and a reviewer. One person writes. A second person, who does not write, reads it all on day 5.

Then write to your contact the same day. Four questions save the most time later:

1. What is the real deadline, and can any section come a few days later?
2. Which product or service, and which of their data, does the questionnaire cover?
3. Do they want documents attached, and which ones?
4. Would something you already have stand in for part of it, such as a security overview or a standard questionnaire you have filled in?

Ask; don’t assume. If the answer to the first question is “no, the date is fixed”, you have learned that on day 1, not day 5.

Day 2: gather the facts

Writing the answers is the short part. The long part is finding out what is true, because the facts sit with whoever runs each system. So before you write a single answer, build a fact sheet: one line per fact, what is true today, and who told you.

• Hosting: which cloud provider, which accounts and regions.
• Sign-in: the identity provider, whether multi-factor authentication is required for everyone, and which kind (an app, a hardware key, text messages).
• Access: who has admin access to production, and how access is granted and removed when someone joins or leaves.
• Laptops: disk encryption, screen lock, updates, and who checks them.
• Customer data: what you hold, where it lives, how it is encrypted in storage and in transit, how long you keep it, and how you delete it.
• Logs and alerts: what is logged, for how long, and who sees an alert.
• Backups: what is backed up, how often, and when a restore was last tested.
• Incidents: who gets called, and when you would tell a customer.
• Your own vendors: which of them touch customer data.
• People: background checks, security training, and the steps when someone joins or leaves.
• Policies: which ones exist in writing, who approved them, and when they were last reviewed.

“I think so” is not a fact. Ask the person who runs the system, and write down what they say. Anything still unknown at the end of the day becomes a short list of questions, each with a name next to it.

Day 3: draft from the fact sheet

Answer from the fact sheet, not from memory, not from a template, and not from another company’s answers you found online. A borrowed answer describes someone else’s controls.

• Easy questions first. The factual ones go fast and show you where the hard ones are.
• One pattern for every answer: the value the dropdown asks for, then one sentence of fact in the comment column.
• “N/A” only when it truly does not apply, with the reason in the comment. If you have no office, say so; that is why the physical-security question is N/A.
• Watch for absolutes. “All”, “always”, and “never” are true less often than they get written.
• Flag, don’t guess. If a question waits on someone’s reply, mark it and move on.

An example answer (fictional):

“Yes. Every employee signs in through our identity provider, and an authenticator app is required. Text-message codes are turned off.”

How long the draft takes depends on the sheet. Our estimate, not a benchmark: at about three minutes a question, a sheet of about 120 questions is roughly six hours of focused work, once the facts are in hand.

Day 4: gaps and documents

By now you know which questions describe a control you don’t run. Answer those “No”, say what you do have, and add a plan only if there is one. Our missing-control guide has the wording, and why a guessed “Yes” costs more than a gap.

Two kinds of gap catch first-timers.

• A policy you don’t have yet. If the questionnaire asks for a written incident response policy and you have none, today’s answer is “No”. You can write one this week, but answer “Yes” only once it is approved and in effect, and give the date it was approved. Our guide to the first five security policies says which ones come first.
• A document you were asked to attach. List every document the questionnaire requests. Send only what exists, and never make a document up to fill a slot. Before you share an internal document, check whether a confidentiality agreement with this customer covers it.

If a gap looks like a hard requirement for this customer, tell your contact now. It is better news on day 4 than on day 5.

Day 5: review, send, keep

• The second read. The reviewer from day 1 reads every answer against the fact sheet. Their job is to find the answer the fact sheet does not support.
• Consistency. Long questionnaires ask the same thing twice in different words. The two answers must agree, and every answer must agree with your website, your privacy notice, and your contract.
• Clean up. Remove flags, internal notes, and people’s names you did not mean to send.
• A short cover note. Say who answers follow-up questions, which answers are partial or planned, and what is attached. If follow-up questions come, answer them from the same fact sheet.
• Keep it. Save the fact sheet and the final answers, with the date. Together they are the start of your answer library, and the second questionnaire should take much less time than the first. Facts go stale, so re-check each one before you reuse it.

If you have less than five days

Ask for more time on day 1, before you need it. If the date holds, compress the drafting, not the fact-gathering or the second read. Those two are what keep a fast answer an honest one. A partial set, with the open questions marked and a date for the rest, is better than a complete set with guesses in it, and you can ask your customer whether they would accept one.

If you would rather hand it off

Blank Slate Creative, LLC answers vendor security questionnaires. This guide draws on public standards and our own judgment, not client work.

The service works on the same rules as the plan above: you give us the facts, and we write answers that match how you actually operate, gaps included. We read each completed questionnaire before it is sent to you. We won’t write an answer for a control you don’t run, and we can’t promise your customer will approve. It is readiness and documentation work only: never an audit, an attestation, or a certification, and not a penetration test. For a SIG Lite, a CAIQ-Lite, or your customer’s own sheet, the questionnaire order page lists the flat price, the size it covers, and the turnaround. For anything else, tell us what you need.

Sources

All read on 2026-10-06.

• NIST, The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29, February 26, 2024), Govern function, subcategories GV.SC-06 and GV.SC-07.
• NIST SP 800-53 Rev. 5, control SR-6, Supplier Assessments and Reviews (control statement, as reproduced at csf.tools).
• The question counts and the time estimate come from our guide to SIG Lite and CAIQ-Lite, which lists its own sources.