If you supply other companies, security questionnaires are part of selling. NIS2 makes covered companies responsible for the security of their supply chain (Article 21(2)(d)), so more customers send their suppliers questions about access control, backups, incident handling and more. Often each customer uses its own Excel file, with different wording for the same questions.
Why it takes so long
- The same question, a hundred ways. "Do you use multi-factor authentication?" appears under different headings, numbers and formats.
- Answers drift. Different people answer different customers, and the answers slowly stop matching each other, or your policies.
- Proof is expected. Customers increasingly ask for the policy, certificate or record behind the answer.
- Deadlines are short. Questionnaires arrive in the middle of a sale or a renewal.
A better way: answer once, reuse every time
- Write standard answers to the common questions. Most questionnaires cover the same ground: governance, access, backups, incidents, suppliers, development, physical security. Write a clear answer for each, in every language your customers use.
- Back each answer with proof. Link the policy, procedure or evidence that supports it, so you can share it when asked.
- Approve before reuse. Only reviewed answers should go to customers, so everyone gives the same, correct answer.
- Match each new questionnaire to your library. Start from your approved answers, then adjust only what is specific to the customer.
- Check before sending. Read every answer once more in the customer's context. Nothing should go out unchecked.
- Offer a trust page. Many questions disappear when customers can see your security status and request documents directly.
What not to do
Avoid answering "yes" to everything. Customers compare answers with contracts and, later, with what happens in an incident. A precise "partially, here is how" builds more trust than an unsupported "yes".
CloudSignLab imports the customer's Excel file, fills it from your approved answers, matched by keywords in any language and by ISO 27001 and NIS2 codes, lets you check every answer and gives you back the customer's own file. See the security questionnaires page.
Start free
