Security Questionnaire Answers From Evidence

Buyers send questionnaires as part of their homework on suppliers. NIST's Cybersecurity Framework 2.0 lists planning and due diligence before entering supplier relationships¹ among its outcomes, along with monitoring supplier risk throughout the relationship. In the US, the FTC's Safeguards Rule goes further for the financial institutions it covers: they must require safeguards by contract and assess service providers periodically².

Before you answer a single row, pin down the scope. Which product, region and deployment is the buyer actually buying, and what data will you hold for them? If nobody has written those boundaries down, a solution architecture document settles them once for every questionnaire that follows.

Then ask the buyer whether something you already have would do instead, such as a completed standard questionnaire or your SOC 2 report under a nondisclosure agreement (NDA).

Gather what you'll cite: your SOC 2 report, ISO/IEC 27001 certificate, latest pen test summary, policies and last year's answers. Note three limits for each. System: the product, region or component it covers. Period: the date or dates it speaks for. Party: who performs each control (you, your cloud provider or the customer).

The AICPA's SOC 2 guide defines a Type 1 report as covering whether controls were suitably designed as of a point in time³. A Type 2 adds whether they operated effectively throughout a stated period, with the auditor's tests and results. A Type 1 can support "designed and in place," not "tested over time."

A Type 2 speaks only for its own period. If yours ended months ago, give the end date and say when the next report is due. For the months since, offer a bridge letter: a signed statement from your management on whether controls have changed materially.

Then check the party. If your report uses the carve-out method for your cloud host, the host's systems are excluded from the description and from the scope of the examination³. Point data center questions to your provider's own report instead.

Keep the buyer's question IDs, order and answer choices, even when your own library words things differently. After each answer, add one or two plain sentences on how the control works, then the evidence: document, section and date. A reviewer should be able to check any answer without a follow-up question.

Standard forms define their answer choices, so read the instructions first. The Cloud Security Alliance's Consensus Assessments Initiative Questionnaire (CAIQ) is one: version 4.1 has 283 questions across 17 domains⁴. Its workbook defines Yes as the control requirement being met, and No as not met while in scope⁵. N/A means the question doesn't apply to the service being assessed, so it is never a polite No.

The CAIQ also asks who owns each control: your company, the customer, a third party such as your cloud host, or you jointly with one of them. Fill that in on every Yes and No (the CAIQ leaves it blank only for N/A). A Yes with no owner reads as a promise that you do all of it.

When the honest answer is No, write No. Then say what is true instead: a compensating control you do run, the documented reason you excluded it, or the date the work will land. If the gap is a missing policy, the information security policy set template is a quicker start than a blank page.

Your SOC 2 report may also list complementary user entity controls: controls your management assumed customers would implement³ for your commitments to hold. Copy any it lists into your answers. The routine things customers do to use your service, such as managing their own staff's access, are what the AICPA's guide calls user entity responsibilities. List the ones that matter as well, so the buyer sees their part before rollout.

Some questions turn on how systems are set up today, not on documents. How long are logs kept? Which regions use customer-managed keys? Which runtime versions are in production? Send each one to the engineer who owns that system, with the question as written, what the buyer is really asking, and the deadline.

Incident questions check practice, not just paper. The CAIQ asks whether your incident response plan covers notifying affected customers, and whether you evaluate it at planned intervals. If your plan is thin, the security incident response plan template covers notification deadlines and tabletop exercises.

Save each final answer with its evidence, period and owner. The next questionnaire then starts from answers you can re-check, rather than a library of bare Yeses. When a new SOC 2 report or pen test arrives, update every answer that cites the old one.

Publishing what you can saves repeat work. Cloud providers can submit a completed CAIQ⁵ to CSA's public STAR Registry⁶, where buyers look up providers' assessments. For prospects who haven't signed an NDA, the AICPA's guide suggests a SOC 3 report, which is designed for general use³. You can ask your auditor to issue one alongside your next SOC 2.

If questionnaires arrive every month, the security questionnaire response template gives you sheets for evidence coverage and open questions, plus a gap memo. To draft every row from your own documents, with its limits stated, use the tool at the top of this page.