50 common security questionnaire questions, with example answers

Every security questionnaire words things differently, but the same topics come up again and again. Below are 50 questions you are likely to see in some form, with an example answer for each.

The example answers describe a fictional company: Northwind Ledger, a 25-person SaaS company hosted on AWS. Copy the shape, not the facts. Every answer you send must describe what your company actually does. If an example says Yes and your honest answer is No, write No and add context (our guide to answering a security questionnaire explains how).

What makes these answers work: they lead with Yes or No, give one or two specific facts, and don't promise more than the company does.

Company and governance

• Q: Do you have a documented information security policy? A: “Yes. Our information security policy is approved by our CEO, reviewed every year, and available on request.”
• Q: Who is responsible for information security? A: “Our CTO owns the security program and reports to the CEO. Security questions can go to security@northwind.example.”
• Q: Do employees complete security awareness training? A: “Yes, when they join and once a year after that. We track completion.”
• Q: Do you run background checks on employees? A: “Yes, for all employees before they start, where local law allows.”
• Q: Do employees and contractors sign confidentiality agreements? A: “Yes, before they receive access to any company system.”

Certifications and audits

• Q: Do you have a SOC 2 report? A: “No. We have not completed a SOC 2 audit. Our controls are described in our security policy, which we can share under NDA.”
• Q: Are you ISO 27001 certified? A: “No.”
• Q: Have you had a penetration test in the last 12 months? A: “Yes. An independent firm tested our web application in March 2026. A summary letter is available under NDA.”
• Q: Do you have a way for people to report vulnerabilities? A: “Yes. Reports go to security@northwind.example, and we acknowledge them within two business days.”

Without a SOC 2 report? Read how to answer the SOC 2 question honestly.

Hosting and infrastructure

• Q: Where is customer data hosted? A: “On AWS, in the us-east-1 region (United States).”
• Q: Do you use subprocessors? A: “Yes. Our current subprocessors and what each one does are listed on our website.”
• Q: Is customer data separated between customers? A: “Yes. Every record is tied to one customer account, and the database enforces access rules so one customer’s users can’t read another’s data.”
• Q: Do you operate your own data centres? A: “No. We use AWS, which is responsible for the physical security of its data centres.”
• Q: Can customers choose where their data is stored? A: “Not currently. All customer data is stored in the United States.”

Encryption

• Q: Is data encrypted at rest? A: “Yes. Our database and file storage are encrypted at rest with AES-256.”
• Q: Is data encrypted in transit? A: “Yes. All connections use TLS 1.2 or higher, and plain HTTP is redirected to HTTPS.”
• Q: How are encryption keys managed? A: “By AWS Key Management Service. Our staff have no access to the raw keys.”
• Q: Are backups encrypted? A: “Yes, in the same way as the live data.”

Access control

• Q: Do you require multi-factor authentication (MFA) for employees? A: “Yes, for our identity provider, cloud console, code hosting and all production systems.”
• Q: Do you support single sign-on (SSO) for customers? A: “Not yet. Customers sign in with email and password or with Google.”
• Q: Who can access production data? A: “Two engineers, for operations and support. The CTO approves access and reviews it every quarter.”
• Q: How often do you review access rights? A: “Every quarter. People who leave lose access on their last day.”
• Q: Do you use role-based access? A: “Yes. Customers give their users roles (owner, admin, editor, reviewer), and employees get only the access their job needs.”
• Q: What is your password policy? A: “At least 12 characters, checked against lists of common passwords. Employees also need MFA.”
• Q: How do you handle employees who leave? A: “We follow an offboarding checklist: accounts are disabled on the last day, and company laptops are returned and wiped.”

Application security

• Q: Do you follow a secure development process? A: “Yes. A second engineer reviews every change, and automated tests must pass before anything is released.”
• Q: Do you scan your dependencies for vulnerabilities? A: “Yes, automatically on every change. We aim to fix critical issues within 14 days.”
• Q: Are development, test and production environments separate? A: “Yes, and we don’t use production customer data in development or testing.”
• Q: How do you protect against common web attacks such as the OWASP Top 10? A: “We use our framework’s protections against injection and cross-site scripting, a strict Content Security Policy, and automated tests for access control.”
• Q: Do you log security events? A: “Yes. Sign-ins, permission changes and data exports are logged and kept for 12 months.”

Incident response

• Q: Do you have an incident response plan? A: “Yes. It sets out roles, severity levels and the steps to follow, and we test it once a year with a tabletop exercise.”
• Q: How quickly will you tell us about a breach? A: “Within 72 hours of confirming a breach that affects your data, or sooner where the law or our contract requires it.”
• Q: Have you had a security breach in the last three years? A: “No.” (Only if that is true.)
• Q: Who should we contact about a security issue? A: “security@northwind.example, which we monitor every business day.”

Backups and business continuity

• Q: Do you back up customer data? A: “Yes. Automatic daily backups, kept for 7 days, stored separately from the live database.”
• Q: Do you test restoring from backups? A: “Yes, at least twice a year.”
• Q: What are your recovery time and recovery point objectives (RTO and RPO)? A: “Our targets are to restore service within 24 hours (RTO) with no more than 24 hours of data lost (RPO).”
• Q: Do you have a business continuity plan? A: “Yes. It covers losing our hosting region, a key supplier or a key person, and we review it once a year.”

Data handling and privacy

• Q: What customer data do you collect? A: “Account details for our customers’ users, and the content customers upload. We don’t collect more than the service needs.”
• Q: Do you use customer data to train AI models? A: “No. Customer content isn’t used to train our models or our providers’ models.”
• Q: How long do you keep customer data? A: “While the account is active. Data a customer deletes is removed from our systems within 30 days.”
• Q: Can customers delete their data? A: “Yes, item by item or their whole account, at any time.”
• Q: Are you GDPR compliant? A: “We process personal data on our customers’ behalf as a processor, offer a data processing agreement, and publish our subprocessor list.” (Describe what you do rather than claiming blanket compliance.)
• Q: Will you sign a data processing agreement (DPA)? A: “Yes. Our standard DPA is available on request.”

Vendors and insurance

• Q: How do you assess your own vendors? A: “Before we use a new subprocessor, we review its security documentation, such as its SOC 2 report, and sign a DPA where personal data is involved.”
• Q: Do you have cyber insurance? A: “Not currently.” (Or the cover you actually have.)
• Q: Do your key providers have independent security reports? A: “Yes. AWS publishes SOC 2 reports, available from AWS.” (These cover your provider, not you.)

Devices and remote work

• Q: How do you secure employee laptops? A: “Company laptops have full-disk encryption, automatic updates and a screen lock, and we manage them centrally.”
• Q: Do employees work remotely? A: “Yes. Every company system requires MFA, and no network location is trusted on its own.”
• Q: Can employees use personal devices? A: “Only phones, for email and MFA. Production access requires a company laptop.”

Turning these into your answers

Go through the list with your own documents open and write your true answer for each one. Where the honest answer is No, say so and add what you do instead. Save the result: most of the next questionnaire will be one of these 50 in different words.

Rendro does this from your own documents: it drafts every answer from your policies, shows the source, and flags the questions your documents don’t cover so you never send a guess.