Security questionnaires from customers: answer them quickly, correctly and only once

This guide explains why the questionnaires come, what they ask and how to build an answer base in five steps that makes every further questionnaire faster.

Why questionnaires arrive more often now

The NIS2 Directive requires many companies to manage the security of their supply chain (Art. 21(2)(d) NIS2 Directive). In Germany, this duty is set out in § 30 BSIG, and the other EU member states have transposed it in their own laws. It does not stop with your customers: they have to assess the risks that come from their suppliers and service providers.

The simplest way to do that is a questionnaire. This is why the questionnaires also reach companies that are not in NIS2 scope themselves: IT service providers, software vendors, logistics firms, engineering offices. On top come questions from insurers, from tenders and from your customers' audits under ISO/IEC 27001 or TISAX.

Use the free applicability check to find out whether your company itself falls under NIS2.

What is typically asked

The wording differs, the topics hardly do. Almost every questionnaire covers these ten blocks:

Access and permissions: who gets which rights, and how are they removed when someone leaves?
MFA: is multi-factor authentication mandatory for remote access, email and administration?
Backup: how often, stored where, separated from the network, when was a restore last tested?
Patch management: how quickly are critical updates installed?
Security incidents: is there a process, and who is informed when?
Suppliers: how do you check your own service providers?
Training: are staff trained on security regularly?
Certificates: ISO/IEC 27001, TISAX, other evidence?
Data protection: data protection officer, processing agreements, transfers to third countries?
Business continuity: what happens if your systems fail?

Once you have good answers for these ten blocks, most of every new questionnaire is already solved.

The three most common mistakes

"Yes" without evidence. A "yes" sounds good until the customer asks for proof or an audit comes up. An answer you cannot show is a risk for you, not only for the customer.

Answering every questionnaire from scratch. If you start at zero every time, it takes just as long every time. And every time someone else words it slightly differently.

Contradictions between customers. Customer A reads "daily backup", customer B "weekly backup". At the latest when two customers compare notes or an auditor sees both answers, it costs trust.

The method in five steps

1. One owner

Name one person who coordinates questionnaires. They do not need to know everything, but they know whom to ask and keep track of deadlines.

2. One answer base

Keep every good answer in one place, not in emails and old spreadsheets. For each question: the short answer (yes, partial, no, not applicable), one explanatory sentence and the topic. This way you find the right answer in the next questionnaire, even when the question is worded differently.

3. Evidence for every answer

Link each answer to what proves it: a policy, a log, a screenshot, a report. You do not have to send the evidence, but you must be able to show it.

4. Approval by a responsible person

Before an answer leaves the company, someone who stands behind it approves it: management, the information security officer or the head of IT. This protects you from well-meant but wrong promises made in sales.

5. A review date

Answers age. A new backup service, a change in the team, an incident: give every answer a date until which it is valid, and review it then.

A good answer is short, true and backed by evidence.

Answers that need extra care

Some questions should never be answered from a template, because the answer can change or has legal consequences:

Certificates: name only valid certificates, with scope and expiry date. A certificate for one site does not cover the whole company.
Incidents in the last twelve months: answer with the current state and agree it with management.
Data protection officer: name and contact must be correct, also after a change.
Transfers to third countries: depend on each individual service and change with every new provider.

For these questions: check them fresh every time, have them approved every time.

"Partial" is a good answer

Many companies shy away from "partial" or "no". Yet an honest answer with a plan is usually better than a "yes" you cannot prove.

An example: "Partial. MFA is active for remote access and administration; email follows by 30 June." The customer sees that you know the topic and are managing it. Then keep those dates; the next questionnaire will ask.

When a questionnaire is not enough

Beyond a certain customer size or criticality, more follows the questionnaire:

Audit request: the customer or an appointed auditor wants to see evidence or check on site.
ISO/IEC 27001: a certified ISMS answers many questions at once, but needs building up and yearly audits.
TISAX: often a precondition for orders in the automotive industry.

If you back your answers with evidence today, half of the work for these steps is already done. Read more about the supplier role under NIS2 in the whitepaper "Your customer's security questionnaire: NIS2 for suppliers and service providers".

How Complass helps

Complass answers customer questionnaires from what your company maintains anyway: controls, their implementation state and the evidence behind them.

Answer library: your approved answers in one place, with short answer, text, sources and validity. A bank of typical questions in German and English helps you get started.
Import the customer's questionnaire: upload the customer's file as xlsx or csv and map the columns.
Proposals from your own state: Complass proposes answers from your library and from the implementation state of your controls. Matching follows fixed rules, no AI involved. Questions on certificates, incidents and similar topics deliberately get no proposal.
Approval by a person: only people with the right "Approve answers" approve answers. Nothing is approved automatically.
Export back to the customer: as xlsx, csv or pdf, in the structure of the original questionnaire.

Every approved answer goes into the library and is ready for the next questionnaire.

Request a demo Try it for 14 days, no payment details

Checklist: answering a questionnaire

One person coordinates questionnaires and knows the deadline.
Known questions are answered from the answer base, not reworded.
Every answer has evidence you can show.
Certificates, incidents, data protection officer and third-country transfers are freshly checked.
"Partial" comes with a date for completion, not disguised as "yes".
The answers do not contradict what other customers received.
A responsible person has approved them.
New answers are added to the answer base, with a review date.
Promised dates are in the action plan.

Not legal advice. This guide gives a general overview and does not replace an assessment of the individual case.