The short version: A supplier security questionnaire is slow because you rebuild the same answers and the same evidence every time. Build one answer library and one dated evidence folder, and each new form becomes a copy, check and send job. Do the setup once, and answer the next questionnaire in a day.
Why do customers send these?
Larger customers carry the risk when a supplier is breached, so they ask suppliers to prove their controls. Contract clauses do not remove that risk. A Protiviti summary of an ASIC cyber survey notes that organisations often treat clauses as a way to pass risk to suppliers, when they still own it.
Government is the same. Services Australia publishes a business Cyber Security Questionnaire for suppliers under the Protective Security Policy Framework. It covers security practices, transparency, foreign ownership and data sovereignty.
Small suppliers feel this most. The Queensland Law Society told the Australian Government's cyber strategy consultation that larger businesses are rethinking how they deal with small suppliers because of third-party risk. A fast, honest answer is now part of winning the work.
What do these forms ask?
Most forms ask about the same eight areas. Here is the plain meaning of each, and what to attach.
| Area | What the buyer means | Evidence to attach |
|---|---|---|
| Multi-factor authentication (MFA) | Every user and admin, not most | Conditional Access policy list, MFA registration report |
| Patching | Fixes applied on a schedule | Patch compliance report with dates |
| Admin access | Few admins, no daily-use admin accounts | Admin role list with owners |
| Backups | Tested, with a copy ransomware cannot reach | Backup job report, last restore test log |
| Endpoint protection | On every device, not only most | Device list against your inventory |
| Staff training | People know what phishing looks like | Completion report |
| Incident response | Someone knows who to call | The plan, with a named contact list |
| Data location | Where their data lives and who can see it | Hosting region and subprocessor list |
Longer international questionnaires such as SIG, CAIQ and HECVAT run to hundreds of questions, according to vendor guides from Drata, Vanta and SafeBase. Those figures vary by version, so check the publisher. Underneath, they still ask about these same areas.
How do you build the answer library?
Write each answer once, in plain English, and date it. This is the whole trick.
- Take the last form you completed, or the one in your inbox now.
- For each question, write a short true answer in a shared document under the area heading above.
- Mark each answer "true for all", "true for most" or "false". Do not blur the three.
- Note the evidence file that backs it up, by file name.
- Add a "reviewed on" date to each answer.
The second form takes half the time of the first. By the fifth, most of it is pasting.
How do you build the evidence folder?
Keep one folder per client or per company, with a file per control and the date in the file name. For example: 2026-10-12-conditional-access-policies.pdf.
Export it from the system itself: the policy list, the report, the log. A screenshot of a settings page is fine if it shows the date. A hand-written "we do this" is not evidence. Our post on the evidence problem covers how to file it so it holds up.
If you're a small business
You are the supplier, and your IT provider holds half the answers. Ask them for the evidence behind each yes, and ask which answers are only mostly true. Then read the form yourself, because you sign it.
If a control is missing, say so and give a date. Buyers are used to seeing gaps. They are not used to seeing a gap hidden.
If you're an MSP
Questionnaires from your clients' customers are now a recurring request, and a service you can price. Keep the library and the folder per client, refreshed every quarter, and you can turn a form around in a day. For how to package and charge for it, see our MSP compliance pricing guide.
Your own house matters too. Buyers send the same form to you when you are their supplier.
Worked example
A 20-person engineering firm gets a questionnaire from a large construction customer on Monday, due Friday. Its MSP opens the answer library built for the cyber insurance renewal. Six of eight areas already have dated answers. The MSP refreshes the MFA and patch reports, finds one admin account without MFA, fixes it and re-exports the report. The backup restore test is four months old, so it runs a new one. By mid-afternoon on Tuesday the form is done, with the firm's director reviewing and signing. The same library then answers the next form in an hour.
Where CYBERWHITE fits
CYBERWHITE scans a Microsoft 365 tenant and shows which controls are met, which are not and which need review, per control, with evidence you can export. That covers the Microsoft 365 questions: MFA, Conditional Access, device and patch settings. Backups, training and the incident response plan sit outside Microsoft 365, so they are recorded through attestation. The product does not verify them and does not fill in a customer's form for you.
It also does not make a buyer accept your answers. Check what each buyer accepts. To see what a buyer would still ask for after your scan, book a free proof check. We scan one tenant with you. You can also see pricing, MSP solutions and the Essential 8 compliance guide.
Your checklist
- Pull the questionnaire and mark the due date.
- Match each question to one of the eight areas.
- Copy answers from your library, then edit for this customer.
- Re-export evidence that is older than 90 days.
- Mark each answer true for all, most, or false.
- Give a fix date for every "most" or "false".
- Have a director read and sign the final form.
- Save the sent form and its evidence together.
- Add new questions to the library for next time.
Sources
- Services Australia: Business Cyber Security Questionnaire (Protective Security Policy Framework)
- Protiviti Australia: ASIC cyber survey key takeaways
- Queensland Law Society: submission on Horizon 2 of the 2023-2030 Australian Cyber Security Strategy
- Drata, Vanta and SafeBase vendor guides to standard security questionnaires (counts vary by version)
Keep reading: Cyber insurance questionnaire: an MSP walkthrough and The evidence problem