Security Questionnaire Answer Pack

Format: Excel workbooks (blank template and filled-in example), plus Word and PDF guide and forms.

A larger customer has sent you a security questionnaire. This pack helps you answer it honestly, quickly and with evidence, and gives you the tools to question your own suppliers.

What you get

• Answer Bank (Excel): about 65 questions customers commonly ask across 14 areas (responsibilities, access, devices, network, data protection, email and people, backups, incidents, suppliers, online services, software, and more), with why they ask, ready-to-edit wording, and what to do if you cannot say yes yet
• Coverage sheet: shows your strong and weak areas automatically
• Supplier Scoring sheet: group suppliers by risk and check each against the checks every supplier in that group must meet. Any gap, or an answer saying an extra sign-in check does not apply, needs a recorded decision and reason from the responsible person. Missing or unacceptable entries are marked for review, not treated as passed
• Evidence Index (list of proof): keep the proof you can send when asked
• Guide (Word and PDF): rules for honest answers, steps that save time, what to say to tricky questions (ISO 27001 certification for managing information security? an authorised test that looks for ways into your systems? a team available all day and night?), what the law expects of suppliers that handle personal data, and how to check your own suppliers
• Contract checklist for organisations handling personal data on a customer's instructions (called processors). It covers UK General Data Protection Regulation (UK GDPR) Article 28 terms. The customer deciding why and how the data is used is the controller; these roles have different legal duties
• Form for checking a supplier before using its services
• Security Overview template: a one-page summary of your security measures to send customers before they ask

Blank template and filled-in example (fictional Example Design Studio Ltd) included.

Who it is for

Small UK businesses, freelancers and agencies that supply larger companies, charities or public bodies, or that buy services holding customer data.

Please note

• Wording is yours to adapt: replace the [brackets] with true facts and keep evidence. Never claim official certifications you have not been awarded or tests that have not been carried out.
• General guidance, not legal advice. Independent, not endorsed by the National Cyber Security Centre (NCSC), the Information Commissioner's Office (ICO), the UK data protection regulator, or an organisation authorised to award certification.
• The ICO says its guidance for organisations deciding how personal data is used and those handling it on their instructions is under review following the Data (Use and Access) Act. Check the current ICO page.
• Spreadsheet formulas were recalculated and checked in LibreOffice, a set of office programs. Not tested in Excel itself.

Published by William Baptist | Tidy Desk Digital.