When a bank, insurer or larger customer sends a security questionnaire, it can feel like an exam. It is better understood as a decision. The reader is trying to work out whether trusting you with money, data or cover is a reasonable risk, and the questions are their way of finding out.
The length varies. Banks tend to be much more comprehensive. Insurers generally ask the basics. But the underlying questions are surprisingly similar.
What they are really asking
- Are robust security protocols in place and working? The basics: a second sign-in step, security updates, malware protection and backups.
- Have they been tested? Testing records, such as penetration tests and a restore from backup, show that controls work in practice, not just on paper. Banks in particular ask for them.
- Is there an incident response plan, and does anyone know it? They want to see that you would respond quickly and sensibly if something went wrong.
- How is personal information protected? Who can reach it, where it is held, and what safeguards are active.
- Who is accountable? A named owner for each control, not a department.
- Who else touches your data? The suppliers and advisers you rely on.
Confident answers need evidence
A confident answer should be backed by evidence: a document, a screenshot, a named owner. A "yes" with nothing behind it is the weakest answer you can give. A policy with no owner, or a control that nobody can show is switched on, tells the reader very little.
Where controls are enforced automatically, such as sign-in rules or device settings, the system itself can produce evidence. That works only when the control is working and configured correctly, and it only covers the controls you have. A control that is missing entirely produces no evidence at all, which makes the gap easy to miss, so look at what is not being reported as well as what is.
What worries a reviewer
- Vague or delayed answers. They suggest that nobody really knows, or that the answer is unwelcome.
- Missing or incomplete documentation. If a policy, plan or record is promised and does not arrive, the reviewer assumes it does not exist.
- Inadequate protections. The basics that are missing, or only partly in place.
- Rapid churn in the people running critical controls. If the people who own the controls keep changing, it is hard to believe the controls are stable.
Mistakes when answering
- Overclaiming. Saying yes when the honest answer is partly.
- Copying last year's answers without checking they are still true.
- Leaving the wrong person to answer, so the answers are guesses.
- Leaving questions blank.
An honest "not yet, and here is our plan and date" is usually received better than an answer that later turns out to be wrong.
Keep a ready set of facts and documents
The single most useful habit is to keep an accurate, up-to-date set of facts and documents ready, so each questionnaire starts from a known position. Typically that means your key policies, who owns each control, where personal data is held, the suppliers that touch it, recent test records, your incident plan and any certificates. The word that matters is up to date. A pack that is a year out of date does more harm than good.
Can a certificate shortcut the process?
Often, yes. Independent certification such as Cyber Essentials or ISO 27001 can answer many questions at once and shorten a lengthy review, because someone credible has already checked the controls. It does not always work: some reviewers still ask their own questions or want to test further. It is a shortcut, not a guarantee. We explain Cyber Essentials in our guide.
The short version
Know what you have, name who owns it, keep the evidence, answer honestly and on time. A reviewer who sees that rarely needs to dig much further.