Compliance
Answering security questionnaires without lying
The 200-question spreadsheet from a prospect's procurement team. How to answer honestly, quickly, and in a way that does not commit you to something you cannot do.
The pressure that produces bad answers
A questionnaire arrives attached to a deal, with a deadline, and it is routed to whoever is least able to say no. The commercial incentive is to answer yes. The consequence of answering yes incorrectly is a contractual representation you cannot meet, discovered during an incident.
The way out is not courage. It is having the answers written down before the questionnaire arrives.
How to make this manageable
Build an answer library once
Fifty to eighty questions cover the majority of what is ever asked. Write those answers carefully, get them reviewed, and reuse them. The second questionnaire then takes hours rather than days.
Use partially, with a sentence
Most questionnaires allow it and most people avoid it. Partially with an honest sentence of explanation is a better commercial answer than an overstated yes, and it is one you can defend later.
Never answer yes to something planned
The question asks what you do, not what is on the roadmap. Roadmap items belong in the comments field, clearly marked as such.
Have one person own the final answer
Questionnaires answered by three people in parallel contradict each other, and the contradiction is what a diligent reviewer notices first.
The answer that buys the most goodwill
A clear no with a compensating control described in one sentence reads as competence. A yes that unravels under a follow-up question reads as either carelessness or dishonesty, and the reviewer will then re-read everything else you wrote with suspicion.
The verdict
Build the answer library before you need it
It converts a recurring emergency into an hour of work, and it removes the time pressure that produces the overstated answers.
Do not commit to a control in a questionnaire to close a deal. It becomes a contractual obligation, and the first person to check will be an incident responder or an auditor.
Disclosure. Some links on this site are affiliate links. Scoring weights are published before any programme is joined, and commission is never a ranking input. Full policy, and the method behind this guide.