How to reuse your security questionnaire answers across clients
Keep one master file with one dated answer per question, copy from it, and review it twice a year.
The problem
A new client sends a new questionnaire. The wording differs, the questions mostly do not. If you write each answer from scratch, a questionnaire takes days and two clients get two different answers to the same question.
One master file
- Keep one document with one answer per question, grouped by area: access, encryption, backups, incident response, vendors, people. The guide hub lists the 16 areas.
- Write facts, not marketing. "MFA is enforced for all staff accounts" is reusable. "We take security very seriously" is not an answer.
- Put the date and an owner on each answer. Someone must be able to say who confirmed it and when.
- Match, then copy. For each new question, find the nearest master answer, copy it, and change only what the question asks for.
- Add new questions back. If a question has no master answer, write it once, and add it to the file.
Keep it true
Review the file twice a year and after any change: a new hosting provider, a new tool that holds client data, a staff change in the security role. An old answer that is no longer true is worse than a late one. If a control is missing, say so and give a date, as in the guide on answering without a certification.
Start with an overview
The free Security Overview builder gives you the first page of the master file: the controls you have, the ones in progress, and a gap list with fix steps. The paid kit starts you with 86 prefilled answers, EUR 49 once.
Guidance and templates, not legal advice. The kit does not certify you. Your answers must match what you actually do.