# A security questionnaire arrives. What should your team do first?

> A security questionnaire is often the beginning of supplier due diligence. Confirm which service it covers, what proof is requested and who approves external answers before drafting responses.

Canonical page: https://assurelane.ai/en/insights/security-questionnaire/
Updated: 2026-09-26 · Sources checked: 2026-09-26

## Establish the service being assessed

The buyer may use only one SaaS product while the questionnaire asks about “your company.” Confirm the contracting entity, product, deployment model and data involved. Practices may differ across products; do not apply one platform's controls to the whole group without checking.

## Separate facts, checks and gaps

Some answers can be supported by existing evidence, such as access policies and recovery procedures. Others require verification by an owner of the actual environment, such as encryption settings or log retention. A third group exposes missing controls or records. Explain the current state and remediation plan rather than marking a control as operating when it is not.

| Subject | Internal owner | Typical evidence |
| --- | --- | --- |
| Access | Security, engineering, IT | Approvals and periodic review records |
| Changes | Engineering, operations | Code reviews and deployment records |
| Suppliers | Procurement, security | Supplier inventory and assessments |
| Incidents | Security, operations, management | Exercises and response records |
| Privacy | Legal, privacy lead | Notices, agreements and data flows |

## Maintain a usable answer library

Version the answers and record which product, date, approver and evidence each answer relates to. Reuse facts across questionnaires only after checking definitions, scope and confidentiality. Do not send architecture diagrams or customer data to unverified recipients.

## Decide whether independent evidence is also needed

A questionnaire alone does not necessarily mean the buyer requires a third-party report or certificate. Read the procurement terms for a separate SOC 2, ISO/IEC 27001 or other evidence requirement. If the buyer asks only about current controls, provide an accurate response. If independent evidence is required, plan the scope and specialist involvement separately.

## Sources

- [AICPA & CIMA — SOC for Service Organizations Overview](https://www.aicpa-cima.com/soc4so)
- [ISO — ISO/IEC 27001:2022](https://www.iso.org/standard/27001)

---
General information only; not legal, audit or certification advice. AssureLane does not issue SOC 2 reports or ISO certificates.