Governance questions in a security questionnaire
Governance questions ask who is responsible for security, whether there is a written policy, and whether you hold a certification or insurance. A small vendor can answer all of them honestly without SOC 2.
What the client wants to know
Governance questions test whether anyone owns security at all. The client wants a named person, a policy that exists in writing and is reviewed on a schedule, and a plain statement about certifications and insurance. A team of 1 to 25 people is not expected to hold SOC 2 or ISO 27001. It is expected to say clearly whether it does.
The 6 questions as clients phrase them
The kit covers 6 questions in this area. The wording varies between questionnaires, the control behind it does not.
- Who is responsible for information security in your organisation?
- How many employees or contractors have access to our data?
- Do you hold any security certifications (SOC 2, ISO 27001)?
- Do you have a documented information security policy?
- Are security policies reviewed and approved at least annually?
- Do you carry cyber liability insurance?
What a good answer contains
- A named person who is responsible for security, with a contact email.
- A written information security policy with an owner, an annual review, and a note that staff have confirmed they read it.
- For certifications: state what you hold. If you hold none, say so and point to the controls you describe instead.
- For insurance: yes or no. If yes, offer the certificate on request.
Watch out for
Do not imply a certification you lack. If the policy is not written yet, say that it is being finalised and give a date. State the gap and the date. Do not make a claim the client cannot verify.
Controls behind these answers
These are the controls the free Security Overview builder asks about for this area. Each line is the statement you can make once the control is in place, followed by the fix step if it is not.
- People: Written security policies exist and staff have read them. If not yet: Write short policies (information security, access, acceptable use, incidents, backups) and have every person confirm they read them.
- Assurance: The company holds cyber insurance. If not yet: Optional. Ask your business insurer for a cyber policy quote if clients require it.
Example: how a prepared answer opens
Question: Who is responsible for information security in your organisation?
[the responsible person] is responsible for information security at [your company] and can be reached at [your security contact].
This is the first sentence only. In the kit the full answer is built from your profile, with an honest variant for each control you do not have yet.
Guidance and templates, not legal advice. The kit does not certify you. Your answers must match what you actually do.