Do not hide provider accounts still excluded.
Home / Security questionnaire from a European client
Security questionnaire from a European client
A “yes” commits far beyond the questionnaire.
Before submission, each response must be linked to an actual control, usable evidence, a scope and any relevant exemption.
What your context changes
Decision to be made
To be addressed firstSee the corresponding pathway →
Before the first response
The questionnaire is not a list of boxes to tick. It is a commitment in the making.
A short answer may describe a policy, a practice, a technical configuration or a future commitment. The review therefore begins with the exact nature of what the client is seeking to establish.
- Does the question concern your company or the service provided?
- Scope immediately changes the response and the evidence that will be accepted.
- Does it ask about the existence of a control or its effectiveness?
- An approved policy does not demonstrate that a control works.
- Will the "yes" still hold true after it is sent?
- The response must hold up at the next audit, incident or renewal.
Response workshop
Four readings for a single line.
Demonstration example, Q44
CLIENT QUESTIONAre privileged access rights reviewed every quarter?
Policy and IAM export available; population incomplete.
An absolute answer would be broader than the actual control.
Decision by the authorised owner.
What accompanies the response
A compact file, that both the client and your teams can pick back up.
- 01Original question and version
The reasoning stays anchored to the document received.
- 02Proposed response and reservation
The wording does not silently broaden the scope.
- 03Qualified evidence
Source, date, scope, owner and restriction.
- 04Internal validation
The owner knows exactly what will be disclosed.
Document available
Start with the actual questionnaire.
The same form allows you to describe the deadline and attach the file, without opening a second process.