9 Things to Do After a Customer or Bank Sends You a Security Questionnaire

1. Know what the answers decide before you write one

The same form can gate a bid, a contract renewal, or nothing more than a yearly file update, and the right amount of effort is different for each. A general contractor's prequalification form decides whether a subcontractor can bid at all. A renewal form from an existing customer usually wants to see progress since last year. Owners who do not ask tend to treat every form as pass or fail and answer accordingly.

• Call or email the sender and ask what the questionnaire is for: new work, renewal, or annual review.
• Get the real deadline, and find out whether partial answers with dates are accepted.
• Find out who scores it: procurement, a security team, or an outside assessor.
• Request any scoring guide or minimum requirements in writing.

2. Learn which tier you are in, because the tier sets the length

Federal bank regulators issued joint guidance on third-party risk on June 6, 2023, and it applies to all banks with third-party relationships. The OCC, the Federal Reserve and the FDIC wrote in that guidance that "not all third-party relationships present the same level of risk or criticality to a bank's operations." Large customers sort vendors the same way. A firm that never touches the customer's systems or sensitive data belongs in a lower tier, and a lower tier means fewer questions.

• Describe in 2 sentences what you access: their network, their data, their site, or none of these.
• Say so plainly when a whole section does not apply, and name the reason.
• Check whether a shorter form exists for your tier before starting the long one.

The 2026 Travelers Risk Index found that fewer than 6 in 10 businesses formally assess their supply chain partners and vendors. A customer that sends you a questionnaire is in the group that does, and 53% of businesses in the same survey said they worry about lost income from a vendor or supplier incident.

3. Sort the questions into 3 piles so the real workload is visible

A 40-line vendor security questionnaire usually comes down to about 8 topics, each asked several ways. We see the same list on forms from contractors, operators, law-firm clients and banks. Once the questions are grouped, the form stops looking like 40 problems.

• Multi-factor authentication: on email only, or on remote access and admin accounts too.
• Endpoint protection on every computer, including shared and field machines.
• Backups: where the second copy lives and when a restore was last tested.
• Email authentication, so nobody can send mail that appears to come from your domain.
• Administrator access: who has it and how it is removed when someone leaves.
• A written incident response plan with a named person who declares an incident.
• Staff training on phishing and payment fraud, with dates.
• Evidence for all of the above, dated before today.

Mark each question with one of 3 labels. "Yes with proof" means a document or screenshot exists now. "Yes without proof" means you believe it is true and cannot show it yet. "No" means it is not in place. The middle pile is the dangerous one, and it is usually the biggest.

4. Give every question one owner so nothing gets answered by assumption

A 2022 joint advisory from CISA, the NSA and the FBI says a contract with an IT provider should specify "whether the MSP or the customer owns specific responsibilities, such as hardening, detection, and incident response." A questionnaire tests whether that split was ever written down. In a company without an IT department, questions default to the owner or the office manager, who then answers for systems an outside provider or a software vendor runs.

• Put a name beside each question: you, your IT provider, or the vendor of a specific system.
• Send each owner only their questions, with the deadline and the proof you need back.
• Keep policy questions yourself. Nobody outside can attest to what your staff are told to do.

5. Attach a dated artifact to every yes so the answer survives a follow-up

In 2022 a cyber insurance policy was declared null and void from its inception after the insurer alleged the insured's MFA attestation did not match what was running. That case, Travelers v. International Control Services, involved an insurance application, and the same test applies to a customer form: someone can check the answer later. A control you cannot document is, for the customer's purposes, a control you do not have.

• Capture a screenshot of the MFA policy showing who it covers, with the date visible.
• Export the latest backup report and the record of the last test restore.
• Save the incident response plan and the security policy as dated PDFs.
• Pull the training completion report for the last 12 months.

6. Read the scope word in each question so a true answer does not become a wrong one

94% of businesses say they are familiar with MFA, and only 60% use it to validate administrative users, according to the 2026 Travelers Risk Index. That gap is where questionnaires go wrong. The form asks whether MFA is on "all remote access" or "all privileged accounts," the owner knows it is on email, and the box gets a yes.

Scope words to watch are all, every, any and always. For a Houston oil and gas service company or a construction subcontractor, "all devices" includes the laptops in trucks, the shared PC in the yard office and the tablets on the jobsite. If endpoint protection covers the office and not the field, the accurate answer is a partial one with a date.

7. Write the honest no with a date so the gap reads as a plan

An honest no has 3 parts: what is missing, who owns the fix, and the date it will be in place. In our experience, customer security teams are closing their own audit findings and want vendors who know where they stand. A no with a date gives them something to file. A yes they later disprove gives them a reason to drop a vendor.

• Close the cheap gaps before the deadline when you can: MFA on remote access, email authentication records, one real test restore.
• Give a realistic date for the rest. A missed date is worse than a later one.
• Never soften a no into "in progress" unless work has started and you can say what was done.

8. Have the signer read every line so the signature means something

The signature on a questionnaire belongs to the business, even when an IT provider wrote half the answers. In 35+ years doing this, the forms that caused trouble later were rarely the ones with a no on them. They were the ones nobody senior had read. A 30-minute sitting with the owner, the person who filled it in and whoever runs IT is enough.

• Walk the yes-without-proof pile one last time. Each item is now proven, changed to a no with a date, or marked not applicable.
• Return the form with the evidence attached and one named contact for follow-up questions.
• Send it through the channel the customer asked for, and avoid emailing passwords or full network diagrams.

9. File the answer pack so the next questionnaire takes an afternoon

Texas SB 2610 protects a business with fewer than 250 employees from exemplary damages if it maintained a conforming cybersecurity program at the time of a breach. The documents that satisfy a customer questionnaire are most of that program. For a business with 20 to 99 employees the standard is the CIS Controls Implementation Group 1, and the questionnaire topics in step 3 overlap it heavily.

• Store the completed form, every attachment and the list of promised dates in one folder with the year on it.
• Put the promised dates on a calendar with an owner, and send the customer the evidence when each one closes.
• Refresh the screenshots and reports on a schedule you will keep.
• Offer the pack up front next year. A customer who already holds current evidence often sends fewer questions.