--- title: "The customer security questionnaire is a trust signal, not paperwork" canonical: https://www.grcmana.io/blog/security-questionnaires-trust-signal published: 2026-04-01 updated: 2026-10-22 authors: ["Harry West"] --- # The customer security questionnaire is a trust signal, not paperwork ## Key takeaways A customer security questionnaire is the regulated buyer's due diligence file, not admin. The buyer reads for consistency across sources, honest exceptions, evidence behind each answer and a named owner who replies fast. Suppliers that run their answers as a maintained, evidenced system turn the questionnaire from deal friction into a trust signal. - **Why buyers send them** — FCA SYSC 8.1 expects firms outsourcing critical or important functions to check the provider can perform them reliably, and PRA SS2/21 says material outsourcing due diligence should cover ICT controls and security. - **Certificates are not enough** — For material outsourcing, PRA SS2/21 tells banks and insurers not to assume a supplier certificate or audit report is sufficient evidence just because it exists, so reviewers read behind the answers. - **DORA reach** — Since 17 January 2025, DORA Article 28 has required EU financial entities to undertake due diligence on prospective ICT providers. It reaches UK suppliers through their EU customers' contracts, not directly. - **Four signals** — A careful reviewer checks four things: consistency with the trust centre and audit report, honest exceptions with a compensating control, evidence behind each answer, and a named owner who replies quickly. I used to be the buyer who rejected supplier questionnaires. For four years as a CISO in financial services, I decided whether technology suppliers passed or failed security review. So here's the uncomfortable part. If your enterprise deal has stalled on a customer security questionnaire, the questionnaire is rarely the problem. The way you answered it is. The buyer reads your answers as evidence of how you run security. Treat the questionnaire as paperwork to clear, and the deal waits. Run your answers as a maintained, evidenced system, and the questionnaire becomes a trust signal. That cuts against most of what the market sells you, which is a faster way to make questionnaires go away. Here's why I hold the view, the strongest argument against it, and what I'd do before the next one lands. ## Why isn't a customer security questionnaire just box-ticking? The usual view is fair as far as it goes. Every buyer sends a different spreadsheet asking much the same questions, so the sensible response is to buy a tool or let AI fill it in. What that view misses is that a regulated buyer is expected to check its suppliers, and the questionnaire is where that check starts. The duplication is real. Prospects send their own formats, each covering access control, encryption, incident response and supplier management in slightly different words, and a small team answers the same ground again and again. Nobody enjoys it. But a bank or insurer isn't sending it out of habit. The questionnaire is how the buyer meets its own obligations: - **The FCA.** The outsourcing rules in [SYSC 8.1](https://www.handbook.fca.org.uk/handbook/SYSC/8/1.html) expect a firm that outsources critical or important functions to make sure the provider has the "ability, capacity, appropriate organisational structure" to perform them "reliably and professionally", and to keep assessing how it performs. - **The PRA.** [Supervisory Statement SS2/21](https://www.bankofengland.co.uk/prudential-regulation/publication/2021/march/outsourcing-and-third-party-risk-management-ss) tells banks and insurers that due diligence on a material outsourcing should cover the provider's "ICT controls and security". - **DORA, through your EU customers.** Since 17 January 2025, Article 28 of [Regulation (EU) 2022/2554](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) has required EU financial entities to "undertake all due diligence on prospective ICT third-party service providers" before contracting. Article 30 then sets the contract terms. DORA doesn't bind a UK supplier directly. It reaches you through your EU customers' due diligence and contracts. The [NCSC's supply chain guidance](https://www.ncsc.gov.uk/collection/supply-chain-security/assessing-supply-chain-security) tells buyers, regulated or not, to build assurance measures into their minimum security requirements for suppliers. Read those together and the questionnaire stops looking like admin. It's the buyer's due diligence file, and your answers go straight into it. ## What is the buyer actually reading for? From the buyer's seat, your answers matter less than what they reveal about how you run security. A careful reviewer is looking for four things: whether your answers agree with everything else you've shown, whether you admit your gaps, whether there's evidence behind each yes, and whether someone owns the response. None of these is a question on the form. All of them decide the recommendation. **Consistency across sources.** The questionnaire gets read next to your trust centre, your [SOC 2 report](https://www.grcmana.io/vault/soc-2/report) and the scope on your ISO 27001 certificate. If the questionnaire says every production system is covered and the [certificate's scope](https://www.grcmana.io/vault/iso-27001/certification-process) says one office, the reviewer notices. A contradiction costs more than a gap, because now the buyer has to work out which answer is true. **Honest exceptions.** A wall of "yes" is a warning sign. Few growing firms meet every control in a bank's question set, and the reviewer knows it. "Partially. Here's the compensating control, and here's the date we close the gap" reads as a firm that understands its own risk. A blanket yes reads as a firm that either doesn't know or isn't saying. **Evidence behind each answer.** The PRA tells firms not to take a certificate or audit report on trust. For material outsourcing, SS2/21 says they should "not assume that their mere existence or provision is sufficient evidence". The same logic runs through every line of the questionnaire. "Yes, we encrypt data at rest" with the standard and the record behind it is an answer. "Yes" on its own is a claim. **An owner, and speed.** Who replies, and how fast, tells the buyer how you'll behave when something goes wrong. Under DORA, the contract must oblige the supplier to help when an ICT incident hits the service it provides. A questionnaire passed between sales and an engineer who has never seen it before is a preview of that incident call. A questionnaire answered fully but inconsistently is still a fail. ## Don't buyers just tick a box, and won't AI answer it anyway? The strongest objection is that nobody reads these closely. Procurement needs a completed file, the reviewer is overloaded, and AI tools can already draft questionnaire answers in minutes. If that's true, effort spent on answers is wasted, and automating the whole thing away is the rational response. It's a fair point about some reviews. Plenty are light. But you don't choose which buyer reads closely, and the regulated ones are told to. A bank following SS2/21 or an EU insurer under DORA is expected to test what you say, not file it. The light reviews you passed last quarter don't help when the next reviewer reads every line. The AI point is half right. AI can draft fast, and drafting was never the hard part. It can't create the evidence, choose the compensating control or own the follow-up call. If your source answers disagree with each other, AI reproduces the disagreement faster and more fluently. Automate the drafting if it helps. What wins the deal is the truth of what the draft is drawn from. ## What should you do about it? Five moves turn the customer security questionnaire from deal friction into proof. None of them needs a new platform. Each needs a decision, an owner and evidence that stays current, so the next questionnaire is answered from a system rather than from memory. 1. **Keep one owned answer source, tied to evidence.** Every answer has an owner, a review date and the record it rests on. When the evidence changes, the answer changes with it. The step-by-step method is in our guide to [answering security questionnaires](https://www.grcmana.io/vault/grc-engineering/security-questionnaires). 2. **Publish what you can, so buyers can serve themselves.** Policies, certificates and report summaries that every buyer asks for belong somewhere they can find them before they ask. A [trust centre](https://www.grcmana.io/vault/grc-engineering/trust-centre) does that job, provided it says the same thing as your answers. 3. **Answer the hard questions honestly.** Where you don't fully meet a requirement, say so, name the compensating control and give a date. That answer survives the follow-up call. A stretched yes doesn't. 4. **Name an owner and a response time.** Not sales, and not whichever engineer is free. One person who can answer follow-ups with authority, and a turnaround the buyer can rely on. 5. **Read each questionnaire as the buyer's requirements list.** The questions you keep answering weakly are your security roadmap, written by the customers you want. Feed those gaps into your programme, and the next questionnaire gets easier for a real reason. ## The question to ask before the next one arrives If your biggest prospect laid your last questionnaire next to your trust centre and your audit report today, would all three tell the same story? If they would, the questionnaire is already working for you. If not, that's where the deal is really stalling. That gap, between what you can prove and what the buyer needs to see, is what I call the Enterprise Trust Gap. Closing it is what makes trust a sales asset rather than overhead. When you're ready to build the answer source, our [security questionnaires guide](https://www.grcmana.io/vault/grc-engineering/security-questionnaires) covers the method, and the [GRC Engineering hub](https://www.grcmana.io/vault/grc-engineering) shows how to keep the evidence behind it current.