How a small team can answer a vendor security questionnaire in an afternoon

A bigger client sends you a spreadsheet with 100 or more security questions before they sign. You have no security team. What do you do?

This is the process we recommend for agencies, freelancers and software firms with 1 to 25 people. It has 6 steps and none of them needs a certification.

1. Ask which sections apply

Questionnaires are written for every kind of vendor. Ask the client which sections apply to a vendor of your size. Ask for more time if you need it. Both are normal requests.

2. Send a one-page overview first

A short Security Overview that lists the controls you have in place often answers many questions before the client opens the spreadsheet. It should say who is responsible for security, where data is hosted, and which controls exist: MFA, disk encryption, backups, an incident plan.

3. Write down what is true today

Go through the controls one by one and mark each as in place, partly in place or missing. Be strict. "Partly" means some systems or some people, not all. Your answers must match what you actually do, because the client may ask you to prove them.

4. Answer gaps honestly, with a date

For a control you do not have, say so, say what you do instead, and give a target date. For example, if MFA is not on every account yet, the honest answer says it is not on every system yet, names enabling it everywhere as the first priority and gives a date. A client can work with a dated gap. A claim that turns out to be false ends the deal.

5. Fix the cheap gaps

Most fixes for a small team are settings you can change in an hour: MFA, full-disk encryption and automatic updates. Do these before you send the answers, and your answers get better without any extra writing.

6. Reuse the answers

Questions are worded differently in every questionnaire, but they ask about the same controls. Keep one answer per control and copy it into the next questionnaire. If the client uses their own spreadsheet, paste the answers in.

A free tool for steps 2 and 3

The Security Answer Kit has a free builder that asks about the controls, writes the one-page overview and lists the gaps with a fix step for each. It runs in your browser and uploads nothing: build your overview. The guide on how to answer a security questionnaire has the same process with more detail.

Disclosure: this account is published by Security Answer Kit, the maker of the tool linked above (EUR 49 for the full kit, the Security Overview builder is free). This article was written with AI assistance and checked against the kit's own content before it was queued, as dev.to's guidelines for AI-assisted articles ask (https://dev.to/guidelines-for-ai-assisted-articles-on-dev).