How to answer a buyer's security questionnaire this week
A buyer has sent a security questionnaire and wants it returned this week. The questions cover your product, people and operating practices, while the evidence sits across policies, reports and previous answers. To answer a security questionnaire well, connect each response to current evidence and make gaps visible before the response leaves your team.
The result you need is a reviewed answer table: what you can say, which source supports it, and who must resolve anything partial or missing. A plausible paragraph without that context can create more review work than it removes.
Define what the questionnaire is asking about
Start with the buyer, the service being assessed and the response deadline. A policy covering your corporate IT environment may not establish how a particular customer-facing service works. Evidence from an earlier product version may not support the current scope.
Read the response instructions. Some questionnaires ask for yes/no answers with explanations; others request document names, dates, attachments or a named control owner. Preserve the original question IDs so reviewers and the buyer can follow the response.
Identify questions that involve a new commitment, an exception to your normal practice or a claim about a supplier. Assign those to the appropriate owner early instead of treating every cell as a writing task.
Build a current evidence pack
Collect the documents relevant to the actual questions. These may include security policies, access-control procedures, incident-response plans, backup procedures, privacy documentation, subprocessors and prior approved answers.
For each source, record its owner, version, effective date and scope. A policy states what should happen; an operating record may show what happened. A backup policy alone, for example, may not establish when a recovery test was last completed.
Avoid uploading a large folder simply because it is available. Irrelevant or obsolete material makes conflicting answers harder to spot. Include the evidence you are authorized to use and explain any scope limitation to the reviewer.
Cloud Security Alliance's CAIQ overview describes a structured questionnaire used to assess cloud security controls. Whether the buyer uses CAIQ or its own spreadsheet, the practical task is still to connect the requested claim with appropriate evidence.
Write answers that can be checked
A useful answer has three parts: a direct response, the scope or qualification that matters, and the supporting source. Avoid copying several policy paragraphs into a cell without explaining which part answers the question.
Consider these fictional examples:
| Question | Evidence available | Draft response | Review status |
|---|---|---|---|
| Are privileged accounts protected by MFA? | Access policy states MFA is required for production administrators | MFA is required for production administrator accounts under Access Policy v3, section 4 | Supported within that stated scope |
| Are recovery tests performed annually? | Backup policy specifies annual tests; no test record supplied | The policy requires annual recovery testing; the latest completed test needs confirmation | Partial |
| Can you provide the latest penetration-test report? | No report in the evidence pack | Request the current report and confirm whether it can be shared | Missing |
The examples show an answer structure, not Arthur & Co's own security controls or a certification. Keep the distinction between a documented requirement and proof of operation visible in the response.
Handle missing evidence without inventing an answer
A missing source is useful information. Record exactly what is needed, who owns it and whether the buyer's deadline allows time to obtain it. “Evidence missing” is more actionable when followed by “latest recovery-test record from infrastructure owner.”
Do not turn a planned control into a completed one. If a question asks about current practice, a roadmap item needs an explicit explanation. The responsible owner should approve any statement about timing or future implementation.
A “not applicable” answer also needs a reason. Explain which service, data or responsibility is outside scope. Using it to avoid an uncomfortable question leaves the buyer without a meaningful basis for review.
Resolve conflicting or outdated sources
Suppose a prior questionnaire says records are retained for 12 months, while the current policy specifies 24 months. Do not choose the newer-looking sentence automatically. Confirm the policy's effective date, applicable data and product scope with its owner.
Keep the conflict in the review record and update the approved answer only after it is resolved. A previous answer is a useful lead, but it is not permanent authority for all future questionnaires.
The same applies to shared-responsibility claims. A cloud provider's report can support a statement about the provider's scope; it does not automatically establish that your team configured every related control correctly.
Use evidence review for the first structured pass
Arthur & Co's Questions and evidence review workflow takes the questionnaire and evidence pack and returns draft answers, source context and coverage gaps. Review the cited material and the scope of each answer before accepting it.
Start with a representative questionnaire that includes straightforward, partial and missing cases. Check whether the result helps the reviewer find the relevant source and understand what still needs confirmation.
The workflow does not submit the questionnaire or certify compliance. Your team owns the final response and any commitments it contains. For a supplier-specific assessment, the vendor due diligence evidence entry provides a related starting point using the same evidence-review job.
Make the handoff easy for sales and security
Keep question ID, proposed answer, source, reviewer and status in the same review record. Put unresolved questions in a short follow-up list with an owner and due date. Sales can then see what is blocking the response without interpreting every technical detail.
Before returning the questionnaire, check that every yes/no answer agrees with its explanation, that document versions are current and that attachments can be shared. Remove internal notes intended only for the reviewer.
For repeated requests, retain approved wording with its source and review date. Reuse the answer only after checking whether the service, question or evidence has changed. This is a review practice; it should not be confused with a promise that the product automatically maintains an approved-answer library.
Start with the next questionnaire in your queue
Choose the actual questions, gather the evidence behind them and review the supported, partial and missing results. A useful first run should leave you with fewer unlocated sources and a clearer list of decisions for the right owners.
The free entry lets you inspect that result before considering paid repeat use and saved history. Keep the buying decision tied to the quality of the answers and review process, rather than an assumed response-time reduction.