The Client Questionnaire Is Not a Trap: Answering Security Questions With Evidence, Not Bluff

A familiar email lands from a client you actually want to keep. Attached is a spreadsheet with sixty rows, a tab called 'Evidence', and a deadline of Friday. The questions range from the sensible to the strangely specific. Your team is three people and a shared drive. Someone says, 'Can we just copy the answers from the last one?' That is usually the moment the trouble starts.

Security questionnaires are not designed to catch you out. They are how larger organisations transfer risk down the supply chain. In 2026, procurement teams are asking sharper questions because their own insurers, auditors and customers are asking sharper questions of them. The good news is that you do not need a perfect security programme to pass. You need accurate answers, sensible evidence, and the confidence to say 'not yet' without sounding like a liability.

Why the questionnaire feels worse than it is

Most questionnaires reuse the same themes: access control, patching, backups, incident response, suppliers, training, encryption, and data handling. The wording changes, but the underlying question is usually: if something goes wrong with you, how much of our data and our reputation goes with it?

That framing helps. You are not being audited for sainthood. You are being asked to describe how you manage a handful of practical risks. A small team that answers honestly and can show a dated screenshot of multi-factor authentication switched on is often more convincing than a larger firm that pastes in generic policy language.

Build an answer bank before the next deadline

The worst time to write answers is when a client is waiting. Set aside ninety minutes and build a reusable answer bank in a shared document or wiki. Structure it around the questions you keep seeing, not around the last spreadsheet you received.

A useful structure is:

• Governance and policies: who owns security, when policies were last reviewed, how decisions get made.
• Access and devices: MFA, password management, device encryption, joiners and leavers.
• Data and backups: where client data lives, how it is encrypted, how backups are tested.
• Suppliers and subprocessors: who touches data, what contracts say, how suppliers are reviewed.
• Incidents and continuity: what happens in the first hour, who calls whom, how you report to the ICO if needed.
• People and training: onboarding checks, phishing awareness, clear reporting routes.
• Physical and environmental: office access, clear desk, device storage.

For each answer, record three things: the short answer, the owner, and the evidence link. Evidence does not have to be expensive. A screenshot of the admin console showing MFA enforced, a ticket showing a patch cycle, a note from last quarter's restore test, or a signed policy with a review date all count. Date every claim. Procurement teams notice when the evidence is older than the policy it supports.

The questions you will see most in 2026

You can predict most of the spreadsheet. Here are five common ones and a useful shape for the answer.

Do you enforce multi-factor authentication? Yes or no, then where. Say which systems: email, remote access, finance, and any admin accounts. If it is not everywhere, say where it is missing and when that changes. A screenshot of the identity provider settings is strong evidence.

How quickly do you patch? Give a realistic rhythm rather than a fantasy target. 'Critical operating system and browser patches are applied within seven days; firmware is reviewed quarterly' is credible if you can show the ticket history. If you rely on automatic updates, say so and show the policy that enforces them.

How do you back up client data? State what is backed up, where it lives, how it is encrypted, and when you last tested a restore. A backup that has never been restored is a hope, not a control. A one-page restore test note is excellent evidence.

What is your incident response process? Keep it short. Who detects, who decides, who communicates, and how you meet the UK GDPR 72-hour reporting window if personal data is involved. If you have no formal runbook, say you have a contact tree and a template, and give the date you will test it.

Which subprocessors do you use? List the cloud providers, email platforms, IT support partners and anyone else who could touch client data. Refusing to answer this one is a red flag. Procurement teams are not looking for zero suppliers; they are looking for visibility.

How to answer a gap without losing the deal

Every small team has gaps. The trick is to describe them in a way that shows control rather than chaos. Use a simple formula: current state, risk, compensating control, dated plan.

For example: 'We do not hold ISO 27001. Our current baseline is Cyber Essentials, with MFA enforced on email and remote access. We have a documented gap around formal supplier audits; we compensate by reviewing supplier security pages and contracts annually. We have booked a scoping call for a formal review in Q2 2026.'

That answer is honest, specific and forward-looking. It is far stronger than claiming a certification you do not have or writing 'we are too small to be targeted'. Small teams are targeted precisely because attackers expect less resistance. Saying so out loud does not fill a procurement team with confidence.

Evidence that costs nothing

You do not need a compliance platform to produce credible evidence. Start with what you already have: screenshots of MFA settings, a device encryption report, a patch dashboard, a restore test note, a training completion list, a supplier register, a signed acceptable use policy, and a dated incident contact sheet. Store them in one folder with a review date. When a questionnaire arrives, you are assembling, not inventing.

Red flags that make procurement teams pause

Some answers do more damage than a simple 'no'. Claiming a certification you do not hold is the big one; it is easy to check and fatal to trust. 'Bank-level encryption' means nothing. 'We have never had a breach' is not a control. Copying ISO 27001 clauses into a small firm's answers, with inconsistent dates and no evidence, is worse than saying you are working towards a baseline. Refusing to name subprocessors, or giving different answers to the same question in two places, also invites follow-up questions you do not want.

A ninety-minute preparation session

Gather your last three questionnaires. Highlight the repeated questions. Build the answer bank around those. Assign an owner for each section. Write down the evidence you can actually produce this month, and the gaps you will close this quarter. Put a review date in the calendar for three months' time. Then answer the next questionnaire from the bank, adding only what is genuinely new.

The underdog advantage here is speed and honesty. A small team can update an answer bank in an afternoon and give a client a straight answer the same week. That is not a weakness. It is exactly the kind of supplier behaviour procurement teams remember when the contract renewal comes around.