A customer questionnaire can look straightforward until you start tracing each answer back to a policy, a setting or a record. The aim is to describe what your business actually does, clearly enough for the buyer to review.
1. Confirm what the buyer is asking about
Ask which product, service and business entity the questionnaire covers. Check the deadline, required format and whether the buyer expects attachments. A question about a hosted application may need a different answer from one about your internal office IT.
Keep the original file and make a working copy. Record a named person who can resolve technical questions and someone authorised to approve the final answers. If a question is unclear, ask the buyer rather than choosing the most favourable interpretation.
2. Build a small evidence list
You do not need to send every document you own. Start by recording what is relevant and who owns it. A simple register can contain the question reference, source, date, scope, owner and any restriction on sharing.
| Question | Available source | Still needed |
|---|---|---|
| How is leaver access removed? | Approved leaver procedure | Redacted completed record |
| Who can administer the tenant? | Administrator-role export | Owner confirmation of exceptions |
| Are policies reviewed? | Policy review schedule | Latest approval record |
A procedure describes the intended process. A completed record can help show what happened in practice. Record that distinction instead of treating the two as interchangeable.
3. Write an answer that the evidence supports
Answer the question first, then add the relevant scope or limitation. Use the buyer's terminology where it fits, but avoid copying a template that describes controls you have not confirmed.
This is a draft example, not a statement about Firmword or a client. Once the owner confirms the facts, revise the answer and record the supporting reference. If a yes/no field does not allow an accurate answer, ask how the buyer would like qualifications recorded.
4. Keep gaps visible
Separate a missing document from a confirmed control weakness. “We have not received the export” is different from “the setting is disabled”. Record what is unknown, who will check it and the agreed next action.
Use “not applicable” only when you can explain why the question does not apply to the agreed service. Do not turn a planned improvement into a current control. Proposed dates and commitments should be approved by someone who can deliver them.
5. Check and approve the response pack
- Do the answers refer to the correct service and entity?
- Are document references and dates accurate?
- Have technical owners confirmed open points?
- Are confidential details redacted and attachments authorised for sharing?
- Has the responsible approver reviewed the final version?
Keep the approved pack and its evidence references together so the next request does not start from scratch. A questionnaire response supports a buyer's decision; it does not guarantee procurement approval or certify the business.
A useful first step
Take five questions and map each one to a source, an owner and anything missing. That is often enough to understand the work before quoting for the full pack.
Firmword provides security questionnaire support and evidence preparation. You can also explore a fictional response and action register.