Customer security questionnaire support
A customer needs security answers before a deal or renewal. We help prepare an evidence-based response for your approval, with a clear account of what is verified, missing or planned.
From €1 300 — a short workbook with existing evidence; larger scope by written quotation
Scope and price are confirmed in writing before work starts.
Discuss your caseWhen you need this service
- A customer sent you a security questionnaire with a deadline.
- Sales is waiting and IT does not know what to attach.
- You do not want to promise things you do not yet do.
The benefit for your organisation
- Your sales team has a prepared answer for the customer, and your technical team does not gather the same evidence from scratch.
- You answer with substantiated statements, without promising what you do not yet do.
What you receive
Draft answers in the customer’s workbook where the format allows it, an organised evidence index and a list of gaps with owners. Each answer identifies its basis: a verified record, a stated practice still requiring confirmation, or a planned improvement. You approve and send the final response.
What determines the scope
We review questions and sub-questions, covered entities and systems, available evidence, interviews, customer portals, contractual questions and revision rounds. A short workbook with missing evidence may require more effort than a longer, well-supported one. Supported files and return format are agreed before starting.
Before you commission the work
Ask the customer what result they will accept and by when. If an ISO/IEC 27001 certificate or SOC 2 report is a hard condition and you do not have it, drafting answers will not produce it. An email question does not automatically require a separate domain audit. Necessary tests are separately scoped before commitment.
Two example scopes to compare
Example A: one entity, one workbook, existing approved policies and test records; draft answers, evidence references and one agreed review. Example B: several systems, inconsistent records and unresolved contract questions; interviews, evidence collection and separately identified technical or legal work. These are scope examples, not client cases or priced packages. We quote after reviewing complexity and available inputs.
Your time and the deadline
Provide the request, the exact date and time zone, approximate volume and a person authorised to confirm facts. Your team supplies evidence and approves statements. We allow for those dependencies before accepting a schedule; the typical 5–15-working-day range is not an urgent-delivery guarantee.
Price, changes and corrections
The written proposal fixes the outputs, price, client inputs and review rounds. We distinguish a defect in the original work from new facts or additional customer requirements before agreeing further charges. A full regulatory assessment is not a compulsory first step.
Sharing evidence safely
First send a description of the request without confidential attachments. We agree access and the document-exchange route before receiving sensitive records. The response can identify evidence without distributing unrestricted copies of internal reports to every customer.
Why pricing is individually quoted
We use an individually fixed price after reviewing the inputs. Question count alone does not measure missing evidence, interviews and checks. You receive scope and total price before work begins; buying another package first is not compulsory.
General scope and acceptance terms
Useful reading
Sample output
Demonstration example — not a real client.
| Customer question | Answer | Evidence |
|---|---|---|
| Do you use multi-factor authentication for remote access? | Yes, for VPN and cloud email | Settings screenshot, October 2026 |
| Have you had a penetration test in the last 12 months? | No. Planned for Q1 2027 | — (stated openly) |