Security questionnaire
A security questionnaire is a structured set of questions — often a spreadsheet or portal form running to hundreds of items — that a prospective customer sends a vendor to evaluate its security posture before buying. Deals routinely stall on them, which is why answering fast and accurately has become its own discipline.
A structured set of questions a customer or partner sends a vendor to assess its security posture, policies, and controls before or during a business relationship.
Security questionnaire.
Glossary · Security QuestionnaireWhy they exist
The questionnaire is the buyer’s vendor-risk instrument: their security team must assess every supplier that touches customer data, and yours is next. Questions cover encryption, access control, incident response, subprocessors, business continuity, and whatever their last vendor incident taught them. Some arrive standardized — the CAIQ for cloud services, the SIG from enterprise risk teams — but plenty are homegrown spreadsheets: overlapping, mandatory, and due before the contract can move. Portal-based reviews raise the stakes further, since answers persist, get re-scored at renewal, and follow the relationship for years.
What answering well takes
Speed and consistency win. Good answers agree with your certifications, your policies, and each other; stale or improvised ones surface in re-reviews and erode trust with the exact audience you were trying to reassure. Teams that handle volume without pain keep a maintained answer library, publish a trust center so common questions answer themselves, and treat anything novel as a one-time write destined for reuse. When the volume outgrows whoever answers them between real jobs, the function gets delegated: Agency’s security questionnaire service completes them for you — from your evidence, with your sign-off, at deal speed. The compounding version of the problem is described under questionnaire fatigue.
Glossary
Send the next questionnaire to us instead
Agency completes security questionnaires from a maintained evidence library — accurate, consistent, fast. 200+ hours saved per year.
Platform Products
Agency AIEnd-to-end cybersecurity and compliance, across the stack you already use.GRC IntegrationsEngineer-operated GRC platform integrationAuditsuisse AIAI-powered evidence collection and analysis for IT audits.Find your auditor
Auditnex makes buying audits simpler and more transparent.
Agency implements the controls, collects the evidence, and manages your auditor relationship on top of the GRC tools you already use.
Explore AuditnexCommon GRC Questions
GRC Platform & Virtual CISO FAQ
The long-form FAQ on how managed GRC and virtual CISO coverage work together.
Read the FAQMore from Agency
See it on the home pageBuild a Security & Compliance Team Led by Your Own Virtual CISO
Forward-Deployed Engineers + AI that lower costs, increase velocity, and raise the bar — from policy to audit to remediation. U.S.-based forward-deployed engineers, supercharged by proprietary AI, operate your program end-to-end — on top of the tools you already trust.