§ Questionnaire translator
What is this question really asking?
Pick a question from a customer's or insurer's security questionnaire. See which habit it is about, the rules behind it, and a plain answer you can adapt.
-
Do you have an incident response plan?
It is really asking about
They want to know that if something goes wrong, people know their roles and who to tell, and that it is written down.
See these habits on the mapThe rules behind it
- NIS2 21(2)(b): Incident handlingArt 23: Reporting significant incidents
- GDPR Art 33: Telling the DPC about a breach within 72 hoursArt 34: Telling affected people about a high-risk breach
- ISO 27001 A.5.24: Getting ready for incidentsA.5.26: Responding to incidents
- NIST CSF 2.0 ID.IM: ImprovementRS.MA: Incident managementRS.AN: Incident analysisRS.MI: Incident mitigationRS.CO: Incident reporting and communication
Evidence that usually answers it
- The plan itself, with a version and a review date
- A named incident lead and a deputy
- A contact list including the NCSC and the Data Protection Commission
- A note of the last time you rehearsed it
A plain answer to adapt
Yes. We have a written incident response plan, last reviewed in [month year]. It names [role] as incident lead, sets out who to contact and how quickly, including the NCSC and the Data Protection Commission, and was last rehearsed in [month year].
Only send what is true. Replace everything in [brackets], and remove any sentence that doesn't describe what you actually do. A questionnaire answer can become part of a contract.
-
Is multi-factor authentication enforced for all users?
It is really asking about
They want to know a stolen password alone is not enough to get into your email and key systems.
See this habit on the mapThe rules behind it
- NIS2 21(2)(i): People security, access control and assets21(2)(j): Multi-factor authentication and secure communications
- GDPR 32(1)(b): Ongoing confidentiality, integrity and resilience
- ISO 27001 A.5.17: Looking after passwords and other secretsA.8.5: Secure sign-in
- NIST CSF 2.0 PR.AA: Identity and access
Evidence that usually answers it
- A screenshot of the MFA policy in your email admin console
- A list of systems where MFA is on
- Any exceptions, and why
A plain answer to adapt
Yes. Multi-factor authentication is required for all staff on [email system] and [other key systems]. [There are no exceptions. / The exceptions are … and are reviewed every … months.]
Only send what is true. Replace everything in [brackets], and remove any sentence that doesn't describe what you actually do. A questionnaire answer can become part of a contract.
-
Do you back up your data, and do you test restores?
It is really asking about
They want to know you could recover your data after ransomware or a failure, and that you have actually proven it.
See these habits on the mapThe rules behind it
- NIS2 21(2)(c): Business continuity, backups and crisis management21(2)(g): Basic cyber hygiene and training21(2)(f): Checking whether measures work
- GDPR 32(1)(c): Restoring access to data after an incident32(1)(d): Regularly testing security measures
- ISO 27001 A.8.13: Backups
- NIST CSF 2.0 PR.DS: Data securityID.IM: ImprovementRC.RP: Carrying out the recovery plan
Evidence that usually answers it
- Your backup schedule and where copies are kept
- A record of the last test restore and how long it took
- Who checks that backups succeeded
A plain answer to adapt
Yes. [Systems] are backed up automatically every [day], with a copy kept [offline / with a separate provider]. We last tested a full restore in [month year]; it took [time].
Only send what is true. Replace everything in [brackets], and remove any sentence that doesn't describe what you actually do. A questionnaire answer can become part of a contract.
-
Is data encrypted on laptops and mobile devices?
It is really asking about
They want to know a lost or stolen device does not mean lost data.
See this habit on the mapThe rules behind it
Evidence that usually answers it
- A device management report showing encryption status
- Your policy for phones used for work
A plain answer to adapt
Yes. All company laptops use [BitLocker / FileVault] full-disk encryption, and work phones are encrypted and managed through [tool]. We check encryption status [monthly].
Only send what is true. Replace everything in [brackets], and remove any sentence that doesn't describe what you actually do. A questionnaire answer can become part of a contract.
-
How do you manage the security of your suppliers?
It is really asking about
They want to know you know who handles your data, and that you have thought about the risk each supplier brings.
See this habit on the mapThe rules behind it
Evidence that usually answers it
- A list of key suppliers and what each one holds or runs
- Data processing agreements where they handle personal data
- Any security questions you have asked them
A plain answer to adapt
We keep a list of our [number] key suppliers, recording what data or systems each one handles. Suppliers that process personal data have a data processing agreement under GDPR Article 28. We review the list every [period].
Only send what is true. Replace everything in [brackets], and remove any sentence that doesn't describe what you actually do. A questionnaire answer can become part of a contract.
-
Do your staff receive security awareness training?
It is really asking about
They want to know your people can spot phishing and handle data carefully.
See this habit on the mapThe rules behind it
Evidence that usually answers it
- Training records with dates
- The content or provider used
- Any phishing test results
A plain answer to adapt
Yes. All staff complete security awareness training [when they join and every year], covering phishing, passwords and handling personal data. The last round finished in [month year].
Only send what is true. Replace everything in [brackets], and remove any sentence that doesn't describe what you actually do. A questionnaire answer can become part of a contract.
-
How quickly do you apply security patches?
It is really asking about
They want to know known weaknesses are fixed before attackers can use them.
See this habit on the mapThe rules behind it
Evidence that usually answers it
- Your update policy and target times
- Update status reports from device management
A plain answer to adapt
Security updates are applied automatically on [devices] and within [14] days on [systems]. Critical updates are applied within [time]. [Provider / role] checks update status every [period].
Only send what is true. Replace everything in [brackets], and remove any sentence that doesn't describe what you actually do. A questionnaire answer can become part of a contract.
-
How do you remove access when staff leave?
It is really asking about
They want to know former staff cannot still get into your systems.
See this habit on the mapThe rules behind it
Evidence that usually answers it
- A leavers checklist
- Account review records
A plain answer to adapt
When someone leaves, [role] removes their access to all systems on their last working day, using a written leavers checklist. We review all accounts every [period] to catch anything missed.
Only send what is true. Replace everything in [brackets], and remove any sentence that doesn't describe what you actually do. A questionnaire answer can become part of a contract.
-
Who is responsible for information security?
It is really asking about
They want a name, and to know that security is somebody's job and that the owners hear about it.
See this habit on the mapThe rules behind it
Evidence that usually answers it
- The named person and their role
- How and when they report to the owners or board
A plain answer to adapt
[Name], our [role], is responsible for information security. They report to [the directors] every [period] and have the authority to [make changes / engage outside help].
Only send what is true. Replace everything in [brackets], and remove any sentence that doesn't describe what you actually do. A questionnaire answer can become part of a contract.
-
Do you maintain an inventory of IT assets?
It is really asking about
They want to know you know what you have to protect.
See this habit on the mapThe rules behind it
Evidence that usually answers it
- The asset list, with owners and dates
- Your record of processing for personal data
A plain answer to adapt
Yes. We keep a list of all company devices, accounts and the main data we hold, with an owner for each. It was last updated in [month year].
Only send what is true. Replace everything in [brackets], and remove any sentence that doesn't describe what you actually do. A questionnaire answer can become part of a contract.
No match yet. Try a single word such as “backup”, “training” or “suppliers”.
Indicative mapping, written by hand from public sources. Not legal advice and not a compliance test. Check anything important against the official texts.