Your biggest customer sent a security questionnaire with a due date.

Sort every question into one of three piles

Tally the piles when you finish. If six questions are written down, nine are account settings, and five are about computers, the account settings are your longest wait, because they depend on someone else’s calendar. (Those counts are an illustration.) Put a name beside each pile so every question has one person responsible for its answer.

NIST’s small business basics cover the same kinds of topics: multi-factor authentication, protecting and testing backups, and updating and patching software. Customers differ in what they ask, so work from the wording on your form.

• Written down. Who is responsible for security, what happens when someone leaves, whether there is a plan for an incident. The answer is a document or a decision, and the owner holds it.
• Set in an account. A second step at sign-in on email, how long mail is kept, who has administrator rights, how backups run. The answer is a setting. Your IT provider or administrator can read it out with a date.
• True of each computer. Which version of Windows, whether updates are current, whether the disk is encrypted. The answer is a count across machines.

Ask the sender three things before you start

Ask by email so the reply is on file. The answers tell you how much room you have, and whether a partial answer with a date is something they have seen before.

1. Who reads the answers, and what happens when an answer is “no”?
2. When is it due, and is a partial answer with a date acceptable?
3. What evidence do they want, if any: a statement, a screenshot, a report?

Answer with what you can show

1. For each written question, find the document, or write one sentence describing what you actually do today.
2. For each account setting, ask your provider to read out the setting and the date they checked it. Save the message or the screenshot.
3. For each question about the computers, get a count. “11 of 14 computers” is an answer.
4. Where the true answer is partial, write what’s true and the date. For example: “Two computers run an older version of Windows and are scheduled to be replaced by March 31.” (That sentence is an illustration, not a real measurement.)
5. Keep a copy of what you submitted, with the date. The next questionnaire starts from it.

Three answers that read better rewritten

Work in the order of who you’re waiting on. The account settings come first, because they depend on your provider’s calendar. The written answers and the computer counts can be done while you wait.

• “Yes, we have a policy,” when nothing is written. Describe what you do today in one sentence, and give the date the written version will exist.
• “Yes, all computers,” when nobody has counted. Count them, then give the number and the date you counted.
• “Not applicable,” when the question assumes a bigger company. A question about a security team can be answered with what you have: “The owner and our IT provider.” Say that instead of leaving it blank.

What a computer scan can answer, and what it can’t

A scan of your computers can supply the third pile: Windows versions, update state, and the programs found, by computer and by date. It can’t read your policies or your email settings, so it answers only some of the questions, and it doesn’t fill in the form. The person who submits the form decides each answer.

For the piles you’re unsure about, we look at them with you. A person reads the result, gives you a dated count for the computer pile, and says plainly which answers a scan can’t support.

The customer is asking because they depend on you, and counts with dates are the answer they can use.

Related

• Cyber Insurance Application Questions You Can’t Answer
• Computers That Can’t Be Updated: Replace, Extend, or Contain
• How to Tell Whether Windows Updates Were Installed
• What a Second Opinion on Your Security Covers

Sources

• NIST Small Business Cybersecurity Corner: Cybersecurity Basics
• CISA: Cyber Essentials