Answering a client security questionnaire about your own tooling

A decade ago a testing firm was rarely asked how it stored its own working papers. Now a mid-size client will send a forty-question supplier assessment before it will let you look at anything. Most of it is boilerplate written for SaaS vendors, which is why so much of it fits badly, and why answering it well is a genuine differentiator.

Read the question as its author meant it

Supplier questionnaires are usually inherited from a template built for a company selling software. When one of those lands on a consultancy, half the questions are about a product you do not sell. The right move is not to write N/A forty times. It is to answer the risk the question was aimed at, in your context, and say that you have done so.

The four answers that decide the outcome

In practice a small number of answers carry the assessment. Getting these right is worth more than polishing the other thirty-six.

Access control. Say who at your firm can open a given client’s findings, and say how that is enforced. "Role-based access" is a phrase; "a tester assigned to the engagement, enforced by the database rather than by the interface" is an answer. If any of your staff can read any client’s report because everyone is an admin in a small firm, say that, and say what compensating control exists. Reviewers are unimpressed by claims; they are extremely impressed by precision.

Second factor. Whether it is required, or merely available, is the whole question. A platform where MFA is a setting somebody could have skipped is materially different from one where enrolment gates first use. If yours also requires a recent check rather than a one-time enrolment, say so, because most reviewers have never seen a vendor make that distinction and it lands.

Sub-processors. List them completely, including the AI provider if you use one, and name whose account the requests run under. A firm that can say the AI runs on its own key, or locally on its own hardware, removes an entire section of the review. A firm that cannot has just added a US-based sub-processor to a transfer assessment it did not know it was in.

Retention and deletion. Give a number and a mechanism. "On request" is not a mechanism. If you can export or destroy an engagement from a screen, say which screen.

On certifications

If you hold ISO 27001 or a SOC 2 report, lead with it: it will short-circuit a large part of the questionnaire and it is the reason you paid for it. If you do not, do not gesture at it. Say you do not hold one, say what you do instead, and offer the specifics. Stating a limit plainly costs one line and buys credibility for everything else on the form; being caught softening one costs the deal.

The strongest answer in any of these documents is a mechanism the reviewer can go and verify, followed by a limit you volunteered before they found it. That combination is rare enough to be memorable.

Answer once, reuse forever

Keep a maintained answer bank with a version and a date on it, and treat it as a real document rather than a folder of old spreadsheets. Every time a client asks something you have not been asked before, the answer goes in the bank the same day.

• One canonical answer per question, with the date it was last verified.
• A named owner, because a stale answer bank is worse than none.
• Links to the underlying evidence, so a reviewer who pushes gets it immediately.
• A short list of the limits you always disclose, so nobody improvises one under pressure.

The firms that win these reviews are not the ones with the most impressive answers. They are the ones whose answers are specific, consistent between two different salespeople, and honest about the edges.