Answering a security questionnaire from your customer

Why the questionnaire arrives, and why it comes back

The legal duty lies with your customer. Under article 21 of the Cbw, direct suppliers and service providers fall within its duty of care, and article 10 of the Cyberbeveiligingsbesluit requires it to check whether they meet its security requirements, and to check this periodically. A questionnaire is how it carries out and records that check. That is why it comes back.

What this means for your position as a supplier is explained on the page for suppliers. This article is about filling it in.

Read the scope first

Before you answer a single question, establish what the questionnaire covers: the whole organisation, or only the service you supply to this customer, with the systems, locations and people it needs. An answer that is true for your whole organisation can be too broad for the service supplied, and the other way round.

Write the scope above your answers. If it is unclear, ask the customer before you start. That prevents answers that later turn out not to fit.

Three kinds of question

Almost every question falls into one of three kinds, and each needs a different answer.

• Questions about policy: do you have an adopted policy for access, backups or incidents? The answer is a reference to a document with a date and an owner.
• Questions about practice: is that policy applied? The answer is evidence that it happens: a report of the last restore test, the date of the last access review, an extract from the incident register.
• Questions about intentions: what do you plan to do? These are rarer and deserve an answer with a date.

Most of the effort is in the second kind. Many organisations have a policy; fewer can show it is applied.

Answer with evidence, not adjectives

'We have a robust backup process' tells the customer nothing it can check. 'Backups run daily; the last restore test was on a given date and is recorded in a test report' does. A good answer says what happens, how often, and which document shows it.

You do not have to send every document. Often a reference is enough, or a summary with the key facts and an offer to let the customer inspect the full document. That keeps internal documents in-house while the answer stays verifiable.

When the honest answer is 'no'

A questionnaire is not an exam you have to pass on every point. The customer is weighing risk; an honest 'no' with a plan is worth more to it than a 'yes' that fails the first check.

With a 'no' or 'partly', state what is in place now, which measure follows and when, and who is responsible. Keep track of those commitments, because the customer checks periodically and will ask about them.

Build one answer set

Many questions recur in every questionnaire, in different words and a different order. Filling in each questionnaire from scratch repeats the same work, and risks giving customers different answers to the same question.

So keep one set with, per topic, the standard answer, the document it refers to, the owner and the date of the last review. The ten elements of the duty of care are a workable structure; see the NIS2 checklist. Have a second person review every completed questionnaire before it goes out.

Who answers, and who reviews

Decide who answers questionnaires and who reviews them. Technical questions need someone who knows the systems; questions about policy, commitments and deadlines need someone who may commit on the organisation's behalf. Often these are two different people.

Compare the answers with what the contract with the customer says. A commitment made in a questionnaire can end up in the agreements later, and an answer that differs from the contract raises questions you would rather avoid. Keep every questionnaire you send with its date, so you know at the next check what you answered before.

When an ISO 27001 certificate helps

An accredited ISO 27001 certificate is the evidence customers accept most readily. It can answer part of the questions, provided its scope covers the service you supply to this customer. Which part of the questionnaire it replaces is for the customer to decide.

A certificate is not mandatory, and without one you can still answer with a well-substantiated evidence file. The difference is the time it takes the customer to assess your answers.