All services Every engagement has a fixed, published price. Book a strategy call
The questionnaire lands mid deal and eats a week. How to answer it in a day instead: the evidence pack, what the reviewer on the other side wants, the certifications that pre-answer whole sections, and when to make it someone's job.
It arrives mid deal, usually on a Tuesday: a spreadsheet with three hundred rows, a customer logo on the cover sheet, and a deadline of Friday. Sales cannot answer it, IT does not have time, and whoever answered the last one has left. The deal waits while the questionnaire eats a week.
We sit on both sides of this table. For buying organisations we design and verify supplier security questionnaires, which means we know exactly what the reviewer on the other side is looking for. For suppliers we run the function that answers them. This guide is what works, from both chairs.
The short answer. Answer customer security questionnaires from a maintained evidence pack, never from scratch: a single source of approved answers, current certificates and named ownership. A core set of fifteen to twenty answers covers most of every questionnaire, certifications such as Cyber Essentials Plus and ISO 27001 pre answer whole sections, and one named owner with a service level turns a week of panic into a day of assembly. If questionnaires keep landing and nobody owns them, you are missing a function rather than failing a form.
Enterprise buyers now run supplier assurance as standard practice. We build those programmes for them, and the volume only rises. Insurers ask suppliers the same questions at every renewal. ISO 27001 obliges certified customers to manage their suppliers, which means their obligations flow downhill to you. And a new section has arrived in the last two years: questions about your AI use, your AI suppliers, and whether customer data touches any model, the mirror image of the checks buyers now run on supplier AI risk. The questionnaires are not going away. The only choice is whether they keep costing you a week each.
Having scored these for buyers, we can tell you the review is faster and more human than suppliers imagine, and five things decide it.
Certificates first. A current, correctly scoped certificate verified against the issuing register answers dozens of rows in one line. It is the strongest single artefact in the pack. Consistency second. Contradictions kill trust faster than gaps: encryption everywhere on row 40 and no key management on row 118 tells the reviewer the answers were written by different people who did not talk. Evidence beats adjectives. We take security seriously scores nothing. A patching cadence, a named incident owner and a tested restore score. An honest no beats a fake yes. No, planned for Q3 reads as maturity. A yes that surfaces false later is not embarrassment. It is potential breach of contract, because your questionnaire answers become warranties the moment the deal signs. Scope precision. Answers about the service the customer is buying rather than your whole company’s ambitions.
The reviewer does not expect perfection. They expect coherence, and coherence is exactly what a maintained pack produces.
| Pack section | What it contains | What it pre-answers |
|---|---|---|
| Security summary | Two pages: who owns security, the controls that operate, the standards held. | The narrative questions and half the cover sheet. |
| Certificate vault | Current certificates with scope statements: Cyber Essentials, Plus, ISO 27001, IASME Cyber Assurance. | Entire technical and governance sections. |
| Core answers | Fifteen to twenty approved answers: access control, patching, backup and tested restore, incident response, data handling and UK GDPR, encryption, business continuity. | The bulk of any questionnaire’s rows. |
| Sub-processor register | Who you rely on, where data goes, including AI tools and their terms. | The supply chain and, increasingly, the AI section. |
| Insurance and incident record | Cyber cover summary, notifiable incident history and outcomes. | The liability questions buyers escalate first. |
Every answer carries a named owner and a review date, because a pack that is not maintained decays into the very inconsistency the reviewer is scanning for. Built once, the pack turns each new questionnaire into an assembly job.
Triage first: deal value, deadline, format, and whether the customer accepts standard artefacts, since many will take your pack in place of their spreadsheet if asked early. Map the questions to the pack. Most rows map directly. Draft the gaps honestly: a no with a date, never a hopeful yes. Review for consistency and scope in one pair of hands, the owner’s, because single ownership is what prevents row 40 contradicting row 118. Submit and log exactly what was sent, because you will be held to it at renewal, at audit and, if the worst happens, in the incident room. Your answers are warranties in waiting. Keep the receipts.
If the same questions keep costing you deals, stop answering them one spreadsheet at a time and acquire the artefacts that answer them permanently. Cyber Essentials, from £320 + VAT, answers the baseline technical rows every UK questionnaire opens with. Cyber Essentials Plus, from £1,150 + VAT, answers the question behind the questions: has anyone independent checked. ISO 27001 collapses entire governance sections and is the certificate enterprise procurement recognises without discussion. The middle rung between them is covered in our three way certification comparison. The honest test for certifying: when the cost of the questionnaires you are losing or labouring through exceeds the cost of the certificate, the market has made the decision for you.
If you receive two questionnaires a year, this article and a tidy folder are enough. If they land monthly, stall deals and consume your best technical people, the fix is ownership rather than heroics. Some organisations assign the function internally using exactly the method above. Others buy it: our Virtual Security Office (vSCARO) runs the whole capability on retainer from £7,500 a month: the evidence pack maintained, questionnaires answered inside customer deadlines, the certification calendar kept, and the supplier register you are increasingly asked about kept current. It exists because customer questionnaires kept landing on organisations where nobody owned them, which is the single most common way security becomes a sales problem.
From a maintained evidence pack, about a day of assembly for most questionnaires, with the genuinely new questions taking the time. From scratch, the industry norm is the week of chased answers and late nights this guide exists to end.
Answer no, with the remediation plan and date. Reviewers read an honest no with a plan as maturity, and they read discovered fake yeses as grounds to escalate, because questionnaire answers typically become contractual warranties once the deal signs.
In the UK, Cyber Essentials Plus and ISO 27001. Many buyers shorten or waive sections for certified suppliers because the certificate, verified at source, answers the underlying question independently. Cyber Essentials from £320 + VAT covers the baseline. ISO 27001 carries enterprise procurement.
They can draft. They must not decide. Questionnaire answers are commitments your company will be held to, so a named human owner has to approve every answer against the evidence pack. An AI drafted yes that turns out to be hallucinated is not a productivity win. It is a warranty breach with a timestamp.
A two page security summary, current certificates with scope statements, fifteen to twenty approved core answers covering access, patching, backup, incident response and data handling, a sub-processor register including AI tools, and your insurance and incident record. Each item carries a named owner and a review date.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
