A potential client, a main contractor or a public-sector framework may ask you to complete a security questionnaire before signing a contract. It's now routine on larger projects.
What they ask
Multi-factor authentication, encryption, backups, staff training, incident response, how you control access to client information, and increasingly whether you hold Cyber Essentials. Central government contracts involving personal data or IT services typically require it.
Keep the evidence together
Current policies, insurance certificates, your Cyber Essentials certificate, recent test results and any other supporting evidence, in one folder. The second questionnaire takes a quarter of the time of the first.
Don't guess
Never say a control is in place when it isn't. Record what's missing, who will fix it and when. A gap with a plan is acceptable to most assessors; a claim that turns out to be untrue is not.
Received a questionnaire you're not sure how to answer? Send it to us. We'll explain the technical questions, gather the evidence and identify anything that needs fixing before you submit.
Want a hand with this? Talk to us.