A Norwegian supplier is close to winning an important customer. Then a security questionnaire arrives. Sales wants to answer quickly, IT says the provider handles most controls, and the CEO is asked to approve a document containing several unconditional yeses.
The commercial risk sits in the distance between those answers and what the company can demonstrate. A polished questionnaire can create expectations the delivery team cannot meet. I would make security evidence part of preparing the offer, before the final deadline makes every unanswered question feel like an obstacle to revenue.
Answer for the service the customer will actually buy
Imagine a hypothetical engineering supplier that will receive confidential drawings from an industrial customer. The customer asks whether access is restricted, information can be recovered and subcontractors are controlled. The relevant scope is the people, systems and locations used for this delivery.
A security report for one cloud service does not describe every laptop, shared folder or subcontractor in the supplier's operation. Similarly, a certification should be described with its actual holder, scope and validity. Do not imply that a provider's certification belongs to your company.
Ask the customer to clarify ambiguous questions through its agreed process. What must be recovered, within what time, and under which conditions? A precise answer about a defined service is more useful than a broad claim that everything is secure.
Build a small evidence pack
NSM's guidance on outsourced services emphasizes lifecycle control, purchasing competence and appropriate requirements. For a supplier answering a buyer, my practical extension is to keep an evidence pack with an owner and review date for each statement.
Start with the claims the customer actually needs to assess:
- Access: who approves access to customer material, how departures are handled and what a recent access review covered.
- Recovery: the scope, date and result of a relevant restoration test, including what was not tested.
- Incident handling: the reporting route, responsible contacts and the commitments your company can actually meet.
- Subcontractors and data handling: which parties support the delivery, their roles and the applicable contractual arrangements.
- Open issues: known limitations, temporary measures and proposed completion dates, with a responsible owner.
This is a suggested starting pack, not a universal compliance checklist. A small low-risk delivery may need less; a critical or regulated service may need considerably more. Ask which evidence the customer requires and how it should be shared.
Replace the unsupported yes with a bounded answer
Suppose the questionnaire asks whether all customer data can be restored within four hours. The supplier has successfully restored a file library, but has not tested recovery of the project system or its identity service.
An accurate answer describes the tested library, its test date and measured result, then identifies the untested systems. If four-hour recovery is a mandatory condition, management must decide whether to fund and validate the capability, propose an acceptable change or decline the opportunity. A planned test is not a completed control.
Do not promise a date just to complete the form. Establish cost, dependencies and who can deliver it. Commercial approval should include the consequences if a security commitment cannot be met, just as it would for an ambitious delivery deadline.
Protect the evidence itself
A customer usually does not need administrator credentials, a raw vulnerability report or detailed network information in an ordinary sales attachment. Share a proportionate summary through an appropriate channel, restrict access and agree when deeper evidence is justified. Remove unrelated customer information and personal data.
If the parties process personal data, identify their actual roles. GDPR Article 28 addresses the controller's choice of processors offering sufficient guarantees and the required processing arrangement. A completed sales questionnaire does not by itself establish that those requirements are met. Confidential business information also needs protection even when it is not personal data.
Assign approval to someone who can stand behind the claim
Sales can coordinate the response. The operational owner should validate the claim, and the authorized commercial approver should accept any new commitment. A small company can use a short review meeting, but it should retain the approved answer, evidence and agreement version.
The board does not need to sign off each questionnaire. It should know when a significant contract depends on controls the company lacks or creates a material concentration or liability exposure. Revenue is not the only number in that decision.
After the bid, update the evidence pack when systems or suppliers change. Use the outsourced IT accountability guide where evidence depends on your provider. Feed recurrent customer questions into the proposal process, so the next offer starts with stronger facts.
Sources and scope
Sources checked on 12 October 2026. The engineering supplier and recovery question are hypothetical. The evidence pack and approval process are my recommendations. Customer contracts, sector rules and data-processing roles may require additional controls; the pack is not a certification.