How to answer a supplier security questionnaire when you don't have ISO 27001 yet
A security questionnaire from a customer, with a question near the top asking whether you hold ISO 27001, is not an automatic "no". Plenty of suppliers answer these without the certificate. What counts is that your answers are honest, consistent and backed by something real. Done well, a questionnaire is also the best free map of what a bigger customer wants from you.
Start with the "no", written well
If a question asks whether you are certified and you are not, say so plainly. Then add one useful sentence: what you do hold or are doing instead, such as a Cyber Essentials certificate if you have one, or that you are working towards ISO 27001 with a named owner. Only write that last part if it is true. Buyers find a clear "no, and here is what we do" far more credible than a vague answer, and an untrue "yes" can end a relationship.
Answer from evidence, not memory
The most common problem is not missing controls, it is answers that nobody can back up. Before you fill anything in:
- Gather your documents. Policies, access lists, backup arrangements, supplier lists and incident procedures. Note what is current and what is out of date.
- Pick one owner. One person writes and signs off the answers so they don't contradict each other.
- Answer what is true today. "Partially" and "planned, due in March" are acceptable answers when they are accurate. Don't round up.
- Attach rather than describe. A short policy attached beats three paragraphs of explanation.
Keep a store of approved answers
Most questionnaires ask the same things in different words: access control, backups, staff training, incident handling, suppliers, data protection. Every time you answer one, save the approved wording somewhere you can find again, along with the document it relies on. The second questionnaire should take a fraction of the time of the first, and your answers stay consistent between customers. That is the real saving: not one fast questionnaire, but never starting from scratch.
What the questionnaire tells you about your gaps
Every "no" or "partially" is a short list of what to fix first, in the order your customers care about. It also shows where you rely on one person's memory. If only one colleague knows how the backups work, that is a risk to you as well as a worry for the customer. Write the gaps down, give each an owner and a date, and you can say in your reply what you are doing about them.
How to move towards ISO 27001 from here
If questionnaires keep arriving, working towards ISO 27001 is a sensible next step, because it gives you one set of approved policies and records to answer from. Certification is awarded by a certification body after an audit, and it takes months rather than weeks. See how long ISO 27001 takes. For the background to these forms, read what is a customer security questionnaire, and for the technical baseline see Cyber Essentials vs ISO 27001. We also have pages for public-sector suppliers, NHS suppliers and ISPs and altnets.
Questions people ask
Will we lose the contract if we say no? Not necessarily. Some buyers require the certificate, many accept a clear plan and evidence. Ask what they need, and don't guess.
Can we copy answers from a previous questionnaire? Yes, if they are still true. Check each one against your current documents first.
Should we claim we follow ISO 27001? Only say what you can show. "Working towards" is fine with evidence; "compliant" or "certified" are not, unless a certification body has said so.
How ClearIMS helps
ClearIMS can draft customer security questionnaire answers from your approved records, with sources, once AI drafting is activated for your organisation. People approve the answers; the AI never approves anything. Each questionnaire can have its own email address, so mail from the customer is filed against it. The same records feed your policies, risks and tasks, so you build the evidence once.
We make the software. Your certification is yours, awarded by your certification body. The price is £300 a month, monthly with 30 days' notice, with unlimited users and no VAT charged.
Got a questionnaire waiting? Book a 20-minute call or try the demo company to see a fully set-up ISMS first.