Third-party breaches are becoming more frequent and more expensive. According to IBM’s 2024 Cost of a Data Breach Report, the global average cost of a data breach reached $4.88 million. And Verizon’s 2024 Data Breach Investigations Report found that 15% of breaches now involve a third party, up 68% from the prior year. Those numbers explain why your prospects’ security teams are sending you questionnaires before they’ll sign a contract.
The security questionnaire has become the first trust signal in any B2B deal. Before procurement signs off, before legal reviews the MSA, someone on the buyer’s side needs to see evidence that you won’t be the weakest link in their supply chain. If your answers are vague, slow, or inconsistent, the deal stalls. If they’re precise and well-sourced, you move forward.
This guide breaks down the most common risk assessment questions into seven categories, with a reusable framework for answering each one well. Whether you’re a CTO filling these out yourself or an MSSP analyst managing them across dozens of clients, the goal is the same: strong answers, fast turnaround, no guesswork.
What these questionnaires actually cover
Most vendor risk assessment questionnaires follow a similar structure, whether they’re based on the Shared Assessments SIG, the Cloud Security Alliance’s CAIQ, a SOC 2 trust services criteria mapping, or a buyer’s custom template. They’re designed to evaluate your security posture across predictable domains: how you protect data, who can access it, what happens when something goes wrong, and how you govern the whole operation. The categories below reflect what you’ll see in nearly every questionnaire, regardless of format.
1. Encryption and key management
The 2022 LastPass breach demonstrated exactly what happens when encrypted data is exfiltrated alongside insufficient key management controls. Attackers accessed encrypted customer vault data plus unencrypted metadata, putting the burden of protection entirely on the strength of users’ master passwords.
Common questions
- Do you encrypt data at rest and in transit? What algorithms and key lengths do you use?
- How are encryption keys generated, stored, rotated, and retired?
- Do you use hardware security modules (HSMs) for key storage?
- Who has access to encryption keys, and how is that access controlled?
- How do you manage encryption for data stored with third-party cloud providers?
How to answer them well
- Name your algorithms and versions: State that you use AES-256 for data at rest and TLS 1.2 or TLS 1.3 for data in transit. Avoid vague answers like “industry-standard encryption.” Assessors want specifics.
- Describe your key lifecycle: Cover generation (using cryptographically secure random number generators), storage (ideally in HSMs or a managed KMS like AWS KMS or Azure Key Vault), rotation schedules, and retirement procedures.
- Clarify separation of duties: Explain who can access keys and how that access is restricted. If your KMS enforces IAM policies that prevent application code from directly accessing raw key material, say so.
- Address multi-tenancy: If you operate a SaaS product, explain whether each tenant’s data is encrypted with unique keys or shared keys, and why.
2. Access control and identity
The October 2023 Okta breach started with stolen credentials to a customer support system, ultimately exposing data for all customers who had used Okta’s support portal. Access control questions exist because a single compromised credential can cascade.
Common questions
- Do you enforce multi-factor authentication (MFA) for all users, including administrators?
- How do you implement role-based access control (RBAC) or attribute-based access control (ABAC)?
- What is your process for provisioning and deprovisioning user access?
- Do you support SSO integration, and which protocols (SAML 2.0, OIDC)?
- How do you handle privileged access management (PAM)?
How to answer them well
- Confirm MFA everywhere: Specify the MFA methods you support (TOTP, WebAuthn/FIDO2, push notifications) and confirm it applies to admin, production, and CI/CD access, not just end-user login.
- Describe your RBAC model: Explain the principle of least privilege in practice. Name how many roles exist, how permissions are scoped, and how you prevent privilege creep over time.
- Explain automated provisioning: If you use SCIM for automated user provisioning and deprovisioning through your identity provider (Okta, Azure AD, Google Workspace), state that explicitly. Manual processes are a red flag.
- Detail offboarding procedures: Describe your timeline for revoking access when an employee or contractor leaves. Same-day revocation is the expectation.
- Cover production access separately: Explain how access to production systems is managed differently from access to corporate tools. Mention just-in-time (JIT) access, bastion hosts, or break-glass procedures if applicable.
3. Incident management and response
The 2023 MOVEit vulnerability (CVE-2023-34362) was exploited by the Clop ransomware group and affected over 2,500 organisations worldwide. How quickly you detect, contain, and communicate an incident is exactly what these questions are probing.
Common questions
- Do you have a documented incident response plan, and how often is it tested?
- What are your SLAs for incident detection, containment, and notification?
- How do you classify incident severity levels?
- Do you conduct post-incident reviews or root cause analyses?
- Will you notify affected customers within a defined timeframe if their data is involved?
How to answer them well
- Reference your IRP by name and review date: Don’t just say “yes, we have a plan.” State when it was last reviewed, who owns it, and how often you run tabletop exercises or simulated incident drills.
- Provide concrete SLAs: Give real numbers. For example: “Critical incidents are escalated within 15 minutes of detection. Affected customers are notified within 72 hours, consistent with GDPR Article 33 requirements.”
- Describe your detection stack: Name the tools (SIEM, IDS/IPS, EDR) and whether you use 24/7 monitoring or a managed SOC.
- Include post-incident process: Mention blameless post-mortems, root cause analysis documentation, and how findings feed back into preventive controls.
4. Organisational governance, policies, and training
Security programmes fail without organisational buy-in. Assessors ask governance questions to determine whether security is embedded in your culture or just documented in a PDF no one reads.
Common questions
- Do you have a formal information security policy? When was it last reviewed?
- Who is responsible for information security at the executive level?
- Do all employees complete security awareness training? How often?
- Do you perform background checks on employees with access to sensitive data?
- How do you manage security requirements in contracts with your own vendors?
How to answer them well
- Name the accountable person: Identify who owns security at the leadership level (CISO, CTO, VP of Engineering) and their reporting line. For smaller companies, it’s fine to say “our CTO owns security and reports directly to the CEO.”
- Cite your training programme specifics: State the frequency (annual at minimum, quarterly is stronger), the platform you use, and whether it includes phishing simulations.
- Reference your policy review cadence: Annual review is the baseline. If your policies are mapped to ISO 27001 Annex A controls or SOC 2 trust services criteria, say so.
- Describe your vendor management process: Assessors want to know you’re not just answering their questionnaire but sending similar ones to your own suppliers. Mention your third-party risk management (TPRM) process.
5. Network security
The 2017 Equifax breach, which exposed 147 million records, was traced back to an unpatched Apache Struts vulnerability and inadequate network segmentation that allowed lateral movement.
Common questions
- How do you segment your network, and what controls exist between segments?
- Do you use intrusion detection and prevention systems (IDS/IPS)?
- How do you manage firewall rules, and how often are they reviewed?
- Do you perform regular vulnerability scans and penetration tests?
- How do you secure remote access for employees and contractors?
How to answer them well
- Describe segmentation with specifics: Explain how production, staging, corporate, and customer data environments are isolated. If you use VPCs, security groups, or zero-trust network architecture, name them.
- State your scanning and testing cadence: Automated vulnerability scans should run at least weekly. Penetration tests should be conducted annually at minimum by an independent third party. Name the firm if you can.
- Cover patching SLAs: Provide your timelines for applying critical, high, medium, and low severity patches. For example: “Critical CVEs are patched within 48 hours of disclosure.”
- Explain remote access controls: Mention VPN or zero-trust network access (ZTNA), device posture checks, and whether you enforce endpoint detection and response (EDR) on all devices that connect to your network.
6. Data privacy and regulatory compliance
Privacy questions go beyond technical controls into how you handle personal data as a legal and contractual obligation. With GDPR fines exceeding €4.4 billion cumulatively since 2018, assessors take these seriously.
Common questions
- What personal data do you collect, process, and store on behalf of your customers?
- Do you have a Data Protection Officer (DPO) or equivalent role?
- How do you handle data subject access requests (DSARs) and deletion requests?
- What certifications or audit reports can you provide (SOC 2 Type II, ISO 27001, etc.)?
- How do you ensure compliance with cross-border data transfer requirements?
How to answer them well
- Map your data flows: Describe what data you collect, where it’s stored (regions), how long it’s retained, and who processes it. A data flow diagram is a strong supporting document.
- Reference your certifications with dates: “We hold SOC 2 Type II certification; our most recent audit period covered January to December 2025” is far stronger than “we are SOC 2 compliant.”
- Explain cross-border transfer mechanisms: If you transfer data outside the EEA, name the mechanism: Standard Contractual Clauses (SCCs), adequacy decisions, or binding corporate rules.
- Describe your DSAR process: Include your response timeline (GDPR requires 30 days), who handles requests, and how you verify the identity of the requester.
- Provide a Data Processing Agreement (DPA) proactively: If assessors have to ask for it, you’ve already slowed things down. Make it available on your website or as a standard attachment.
7. AI and GenAI risk
This is the category most older guides skip, but it’s appearing on nearly every questionnaire now. In early 2023, Samsung banned employee use of ChatGPT after engineers inadvertently submitted proprietary source code and internal meeting notes to OpenAI’s servers. Assessors want to know how you govern AI internally and whether your product uses AI in ways that affect their data.
Common questions
- Do you use AI or machine learning in your product, and if so, how?
- Is customer data used to train AI or ML models?
- What controls govern employee use of generative AI tools (ChatGPT, Copilot, etc.)?
- How do you validate the accuracy and safety of AI-generated outputs?
- Do you have an AI acceptable use policy?
How to answer them well
- Separate product AI from internal AI: Your answer should clearly distinguish between AI features in your product (that process customer data) and internal use of AI tools by your employees. These are different risk profiles and assessors treat them differently.
- State your training data policy explicitly: If customer data is never used to train models, say that in plain language: “Customer data is never used to train, fine-tune, or improve our AI models. All inference is performed on isolated, stateless requests.”
- Describe your internal AI governance: Reference your acceptable use policy, any approved tools list, and how you prevent sensitive data from being submitted to third-party AI services.
- Explain output validation: If your product uses AI, describe how you ensure accuracy. Techniques like retrieval-augmented generation (RAG), human-in-the-loop review, confidence scoring, and citation of source documents are all relevant here.
- Name your model providers and their data handling: If you use OpenAI, Anthropic, or another provider’s API, confirm that you use the enterprise/API tier (not consumer), that data is not used for training, and that you have a DPA in place with the provider.
Key things to get right in every answer
Regardless of category, six principles apply across every response you write:
- Clarity over jargon: Write for a security analyst who reviews hundreds of these a week. Clear, direct answers get approved faster. If a question asks for a yes/no, lead with the yes or no, then explain.
- Consistent terminology: If you call it “AES-256” in one answer, don’t call it “256-bit AES encryption” in another. Pick your terms and stick with them throughout the questionnaire.
- Evidence and verification: Wherever possible, point to supporting documents: your SOC 2 report, penetration test summary, information security policy, or architecture diagram. An answer with a reference is always stronger than one without.
- Right level of technical detail: Match the depth of your answer to the depth of the question. A checkbox question about MFA doesn’t need three paragraphs. A free-text question about your encryption architecture does.
- Supporting documentation ready to attach: Have your SOC 2 Type II report, ISO 27001 certificate, penetration test executive summary, DPA, and information security policy packaged and ready. Scrambling to find these documents is where days get lost.
- Map to recognised frameworks: When your controls align with SOC 2 trust services criteria, ISO 27001 Annex A controls, or NIST Cybersecurity Framework functions, say so. It gives your answers immediate credibility with assessors who think in those terms.
Why this takes so long
The scale of these questionnaires is genuinely significant. The SIG (Standardized Information Gathering) questionnaire from Shared Assessments contains over 800 questions in its Lite version and more than 2,000 in the full version. The Cloud Security Alliance’s CAIQ v4 includes approximately 260 questions. Many enterprise buyers send custom questionnaires with 200 to 500 questions of their own.
For a typical SaaS company fielding 5 to 10 questionnaires per month, the time adds up fast. Each one can take 3 to 5 days of focused work when you’re pulling answers from scratch, hunting for the right policy document, and getting sign-off from engineering leads. Multiply that across concurrent deals and it’s easy to see how questionnaires become a bottleneck that directly delays revenue.
Stop losing weeks to questionnaires
ResponseHub was built by a founder who lived this exact problem. You upload your security policies, and the platform uses a RAG pipeline to draft answers grounded in your actual documentation, with citations to the exact page, section, and sentence. Your team reviews and approves rather than writing from scratch.
The result: questionnaires that took 5 days now take hours. Your answers are consistent, cited, and accurate every time. No more digging through Google Drive at midnight trying to find last quarter’s penetration test summary.
Get started with a free trial in under 5 minutes. No sales call needed, completely self-serve. And if you want a deeper look at how top-performing teams structure their questionnaire workflows, download our free guide to security questionnaire automation.
