| A client security questionnaire asks a supplier how it protects information and manages security risk. The answer should describe the service and systems in scope, what is actually in place, any exceptions and the records that support it. |
The client security questionnaire arrives on a Tuesday and is due on Friday. Forty-one questions, a customer logo at the top, and a note saying the contract cannot be signed until it comes back.
It lands in the sales inbox and is forwarded to the operations manager, then to the IT provider, who answers the questions about the systems it manages and leaves the rest.
By Thursday somebody is tempted to write yes against the questions nobody can check, because yes looks like the answer that gets the contract signed. Treat that scene as illustrative, and as the point to stop.
Start instead by confirming the deadline, the buyer’s requirements and who will approve the response. Ask your IT provider for the technical information it can verify, and assign business questions to the people responsible for those processes. Where something is unclear or unverified, say so and agree the next step with the buyer.
Exodesk can help review the technical questions, gather agreed supporting records and identify gaps. The business confirms its wider processes and authorises the final response. Remediation, certification and legal or insurance advice are separate work.
One boundary before we start. Where a buyer asks for a certificate, what ISO 27001 certification involves is a different project on a different timescale, and this guide stays with the client security questionnaire in front of you.
What Is a Client Security Questionnaire?
A client security questionnaire is a structured set of questions a customer, insurer or prime contractor sends a supplier, covering how the supplier protects information, controls access and responds to incidents. Buyers also call it a vendor security questionnaire, and procurement teams file it under third-party risk management, shortened to TPRM.
Longer versions are called a due diligence questionnaire, or DDQ. Some buyers write their own questions, and others start from a standard question set.
Two standard sets appear by name. The Consensus Assessment Initiative Questionnaire, or CAIQ, is published by the Cloud Security Alliance for assessing cloud security controls. Standardized Information Gathering, or SIG, from Shared Assessments, is a broader third-party risk questionnaire that a buyer can scope to the relationship.
Not hosting infrastructure does not remove application, access, privacy, supplier or continuity questions. Where a section looks irrelevant, explain the shared responsibilities and confirm with the buyer whether it applies.
Read the covering email before the questions. It names who wants the form back, by when and through which channel, and sometimes how the answers will be assessed.
Why does a customer send one?
Because the customer has duties of its own. Information privacy principle 5 under the Privacy Act 2020 requires an agency holding personal information to protect it with reasonable security safeguards, and where it gives the information to a service provider, to do everything reasonably within its power to prevent unauthorised use or disclosure.
A client security questionnaire is one way a customer shows it has considered those safeguards. The Act does not require this particular form, and completing it does not discharge either party’s duty, but it explains why the questions are asked.
Ask who inside the buyer reviews the answers. A response headed for a risk committee may need different supporting material from one a project manager is checking.
Which businesses get sent one?
Any business that holds, moves or can reach another organisation’s information. Professional services firms, software suppliers, payroll bureaux, logistics operators, marketing agencies and contractors with building access all receive them.
Size alone does not set the length. The buyer’s process, the service, the information involved and the access granted shape the questions, so a small supplier can still receive a long form.
What Do Buyers Check on a Client Security Questionnaire?
Buyers check whether each answer is accurate for the systems in scope and whether someone can show what supports it. Saying a control exists is the start; the buyer wants to know where it applies, how it is enforced and when it was last checked.
Take a question that appears on many forms: do you enforce multi-factor authentication, shortened to MFA. Running Microsoft 365 does not make the answer yes. Registration for MFA, an available setting and enforced access are different facts.
Microsoft documents three ways to require MFA: security defaults, Conditional Access policies and legacy per-user MFA, each with different licensing and behaviour. Check the method actually used, the accounts and applications it covers, any exclusions and the relevant sign-in results. VPNs, line-of-business applications and third-party accounts are confirmed separately.
An answer to the MFA question can follow a simple template.
- Status. The verified position, such as enforced, partial or awaiting verification
- Scope. The systems and account types covered
- Enforcement. The method in use
- Exceptions. Known exclusions and the controls around them
- Last checked. The date and the source of the check
- Other systems. Their separately confirmed status
How do you find the question behind the question?
Read each question for the scope it assumes, the enforcement it implies and the owner it does not name. A question about backups becomes the systems covered, the schedule they run on and the date and result of the last restore test.
Write that translation down once and keep it with the answer. The next buyer will word the question differently, but the facts behind it can be checked and reused.
Who Should Answer and Approve a Client Security Questionnaire?
Each section goes to the person who can verify it, and the business approves the whole response. A director may be the right approver, but the buyer’s requirements and the business’s delegated authority decide who signs.
Technical owners verify their sections. Your IT provider can speak for the systems it manages and the records it holds, while operations, HR, legal and insurance owners verify the staff, supplier, premises, contract and cover questions.
The final approval applies to every answer, including the ones that say yes. It turns a set of answers into a statement the business stands behind, which is a different act from confirming that a setting is switched on.
Leaver questions show the pattern. A buyer asking about staff departures wants to know how access is removed and checked, so point to how access is granted and removed and share a summary of the last review if the buyer needs it.
What should the IT provider be asked for?
Ask for verified technical information and agreed supporting records, with the scope and date of each. A provider can confirm settings, reports and restore results for the systems it manages.
Where a provider drafts answers, read them before they go. The provider’s scope and your business are not the same shape, and questions about staff, subcontractors and premises belong to the business.
Which Questions Appear on Many Client Security Questionnaires?
Access control, multi-factor authentication, patching, backup and restore, incident response, staff training, subcontractors, data location, breach notification and certification appear on many forms. The wording and depth vary by buyer, so treat the list as a starting point rather than a promise of what every form contains.
| The question as asked | What it is testing | Support that may help |
|---|---|---|
| Do you enforce MFA? | Method, scope and exceptions | Dated record of the enforcement method, coverage and exclusions |
| How do you review access and remove leavers? | Whether access is checked and removed | The last access review and the leaver process |
| What is your patching schedule? | Whether patching is measured | Patch compliance report for a recent period |
| Do you back up your data? | Whether a restore has been tested | Date, scope and result of the last restore test |
| Do you have an incident response plan? | Whether it is current and exercised | Plan summary and the date it was last reviewed or exercised |
| Do you train staff on security? | Whether training happens and is tracked | Programme summary and completion figures |
| Who are your subcontractors? | Who can reach customer information | Supplier list for the service in scope |
| Where is our data stored? | Location and provider | Data map naming the region for each relevant system |
| Will you notify us of a breach? | The trigger and timeframe you will commit to | Notification clause and internal escalation path |
| Do you hold certification? | Scope and currency | Current certificate and scope statement |
The breach notification row has a legal floor. Under the Privacy Act, an agency must notify the Privacy Commissioner and affected people as soon as practicable after becoming aware of a privacy breach that has caused or is likely to cause serious harm, subject to the exceptions. The Office of the Privacy Commissioner asks agencies to aim for 72 hours; that is guidance, not permission to wait.
A contractual notice to the buyer can cover a wider set of incidents and start from a different trigger. There is no universal 24 or 48 hour rule, so agree the trigger, the recipient and the escalation, and write the commitment into the plan you would follow on the day.
How does ISO 27001 certification help with a client security questionnaire?
ISO/IEC 27001 certification can help a buyer assess the information security management system within the certified scope. Provide the current certificate and scope, then answer the buyer’s service-specific questions.
Certification does not automatically prove every control or replace the questionnaire, and a plan to seek certification is not a certificate. SOC 2, short for System and Organization Controls, is a different report from a different scheme, so name whichever one you hold.
What Belongs in a Security Evidence Library?
A security evidence library is a controlled internal set of the records that support your client security questionnaire answers, kept with owners, review dates and access controls. Support can be a policy, a configuration record, an operational report, a test result or a qualified explanation, so not every answer needs its own document.
Twelve records make a reasonable starting checklist: MFA enforcement, patching, access review, backup restore testing, the incident response plan, the policy set, training records, the asset register, the supplier list, the data map, the insurance schedule and asset disposal records. Your buyers and services may need more or fewer.
Keep the full records in a controlled shared location with named owners, permissions, versioning and recovery arrangements. If the library only exists in one person’s OneDrive, it leaves when they do.
When should each record be reviewed?
Set a review date for each record and list the changes that trigger an earlier check. A restore test can stop representing the environment after a major system change, an insurance schedule expires on its renewal date, and an access or asset list can change the day someone leaves.
A disposal certificate records an event; it does not expire on a timer. What matters is whether a record still describes the period and scope the buyer asked about.
How Should You Share Evidence With a Buyer?
Share only what the buyer needs for the client security questionnaire, through an agreed secure channel, once the business has approved it. A current summary or a supervised review may suit the buyer better than a full export.
- Recipient. Confirm the person and their authority before sending anything sensitive
- Restrictions. Check third-party sharing limits and any confidentiality agreement
- Disclosure copy. Keep the internal record separate from the version approved for sharing
- Redaction. Remove unrelated personal information, credentials and sensitive infrastructure detail
- Sharing record. Note what was shared, with whom and when
Named training records, exception lists and detailed security configuration are not default attachments. Offer a summary first and agree anything more detailed with the buyer.
How Should You Answer a Question You Cannot Say Yes To?
Describe the verified position. Where the buyer’s form allows it, a partial or qualified answer, work in progress or a status awaiting verification is more useful to the buyer than a yes that overstates the control.
If a form offers only yes or no, ask the buyer how to record qualifications, and do not select yes where it overstates the control. Where remediation is planned, agree it with an accountable owner before giving a completion date.
Unknown is different from not applicable. N/A needs a reason based on scope, not a missing record or an unclear question. Outsourcing card processing, for example, does not remove a merchant’s own payment security responsibilities, so check the payment flow and the exact question before using N/A.
What happens if an answer turns out to be wrong?
Inaccurate answers can have contractual or insurance consequences, depending on the terms, the facts and the applicable law. Some buyers carry questionnaire answers into the supply agreement, and an insurance proposal form asks for accurate disclosure.
Correct an inaccuracy promptly, explain the verified position and involve the appropriate adviser. The Contracts of Insurance Act 2024 changes disclosure duties from 15 November 2027, and the current rules apply until then.
Should you ever leave a question blank?
No. A blank can read as a hidden no and invites a follow-up. Answer with the verified status, or ask the buyer in writing what the question means and keep that exchange with your answer.
How Long Should a Client Security Questionnaire Take?
It depends on the form, the systems in scope, the records already available and the people who need to verify answers. Agree a target after triage, once you know which answers are verified and which need work.
The first questionnaire takes longer than the ones after it, because the records have to be found, checked and dated. Reused answers still need revalidating for the next buyer, since the environment and the question can both change.
The buyer’s deadline is a constraint to manage, not a reason to overstate a control. If the date is tight, tell the buyer early which answers will follow and when.
What slows the first one down?
Waiting on records that exist but have not been exported or checked. Ask for the technical records in the first hour, with the questions they support, so the people producing them know the scope and period required.
What Affects the Cost of Questionnaire Help?
The work depends on the questionnaire, the systems in scope, the available records and the deadline. We agree which technical answers and supporting records we will help prepare, identify gaps and quote any further work separately.
- Systems in scope. How many systems hold or reach the buyer’s information, and whether they are documented
- Existing records. Whether reports and test results exist and are current
- Questionnaire format. The length, any standard set used and the response options the buyer allows
- Ongoing upkeep. When records are reviewed and answers revalidated
- Separate work. Building missing controls, legal review, buyer follow-up and certification
A reusable library can reduce repeated work, but it does not secure an award, buyer acceptance or insurance cover. Where the true answers are unclear, a security audit establishes what is actually in place before a buyer asks.
How Do You Answer a Client Security Questionnaire, Step by Step?
Read the whole client security questionnaire before answering a single question, then work through six steps.
Confirm the scope
Confirm the buyer, deadline, service, entities and systems in scope, and verify the recipient before sharing sensitive information.
Assign owners
Give each question an owner, and separate verified answers from those needing confirmation, partial or missing controls and requirements that do not apply.
Gather dated support
Collect dated support for the actual answer, recording the scope, exceptions and any limits in the available information.
Answer accurately
Use the response options the buyer allows, ask about unclear questions and do not turn uncertainty into not applicable.
Agree plans and approval
Agree any remediation with an accountable owner before giving a date, then obtain the required business approval.
Submit and keep a record
Submit through the agreed channel, keep the approved response and sharing record, and revalidate reused answers for the next buyer.
Get Help With a Client Security Questionnaire
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide. We help review the technical questions on a client security questionnaire, gather agreed supporting records and identify gaps, while the business confirms its wider processes and approves the response.
NEXT STEP
Is a client security questionnaire on your desk?
Tell us the buyer, the deadline and the systems in scope. We will help review the technical questions, gather the records that support them and show where the gaps are before you answer.
Want to know where you stand first? Request an IT assessment, or see our cyber security services.
Frequently Asked Questions
What is the difference between a client security questionnaire and a security audit?
A client security questionnaire collects the supplier responses and supporting information. An audit assesses evidence against defined criteria. Audits can use remote or onsite work, and either process can have a deadline.
Can you refuse to complete a client security questionnaire?
You can discuss scope, confidentiality, alternative evidence or timing with the buyer. Whether refusal affects the contract depends on its procurement requirements. Do not assume every question can be answered or waived.
Do you need ISO 27001 certification to answer buyer security questions?
Not automatically. Check the buyer requirements. If certified, provide the current certificate and scope alongside relevant answers. A readiness plan is different from certification, and some buyers require certification as a condition.
What happens if you answer a client security questionnaire incorrectly?
Inaccurate answers can affect procurement, contractual commitments or insurance. Correct them promptly, explain the verified position and involve the appropriate business owner or adviser. The consequences depend on the terms and facts.
How much does a security evidence pack cost to build?
It depends on the systems, the questionnaire, the available records and the gaps. Ask for scope and pricing that separate preparation, ongoing updates, missing-control work and any legal or certification requirements.
Is the customer or the supplier responsible for data security?
Both can have duties. The customer must consider safeguards when using service providers, and the supplier must meet the obligations applying to its role. A completed questionnaire alone does not establish compliance.
Does a small business get a shorter client security questionnaire than a large one?
Not necessarily. The buyer process, service, information, access and risk influence the questions. Ask for proportionate scope, but do not assume a fixed length or an automatic reduction for a small business.
Can an IT provider complete a client security questionnaire for you?
A provider can help with technical questions it can verify and agreed supporting records. The business confirms its other processes and authorises the final response. Agree the scope rather than assuming a fixed share.
How quickly must a New Zealand business report a privacy breach?
Notify the Privacy Commissioner and affected people as soon as practicable when a breach causes or is likely to cause serious harm, subject to applicable exceptions. The 72 hour aim from the Office of the Privacy Commissioner is guidance. Contractual notices can have different triggers and deadlines.
What is a CAIQ or a SIG questionnaire?
CAIQ is the cloud security questionnaire published by the Cloud Security Alliance. SIG is the broader third-party risk questionnaire from Shared Assessments. Confirm the version and scope the buyer uses, because not every section applies to every relationship.
What should you do first when a client security questionnaire arrives?
Confirm the buyer, deadline, service and systems in scope. Assign owners, identify verified answers and gaps, and request the relevant records. Ask about unclear questions before submitting qualified answers for approval.
Contact us or call 0800 396 337 to talk about a questionnaire your business needs to answer.
