Skip to content
PHP2Shell: the critical PHP vulnerability and how to patch it
Black Shard

Popular

Black Shard
Talk to us24/7 incident line 1800 370 270

Report

Security questionnaires and tenders: what buyers ask, and how to answer

Buyers ask about the same controls in different words. A supplier that keeps the record behind each answer, and states its gaps with a date, answers faster and is believed.

  • Tools read 26 Oct 2026
  • PDF, 8 pages, 279 KB
  • BS-RPT-05, version 1.0
Download the PDF, PDF, 8 pages, 279 KBEvery report

Executive summary

Our security questionnaire translator sorts each question into one of 56 control families. It flags 8 of the 56 as asking for an artefact that most small and mid-sized suppliers do not hold.

We group the 56 families into 10 themes, the way a tender response is usually organised. Infrastructure, devices and email: 11 control families, none of them scarce. Assurance and testing: 4 control families, 3 of them scarce.

Our cyber insurance readiness check asks 22 questions in 9 groups, grouped the way proposal and renewal forms group theirs.

Most questions are answered from records a well-run firm already keeps: a policy export, a backup restore record, a list of administrators, a certificate of currency. The questions that hurt are the few that ask for an artefact the supplier does not hold, and the answers that hurt most are the ones that imply it does.

  • Keep one evidence pack with the record behind every common answer, and update it when a control changes.
  • Answer each question with what is in place, the exceptions, and the date they close.
  • For a scarce artefact, say plainly that you do not hold it, and offer the evidence you do.

Report

The figures

What security questionnaires ask about

Stacked bar chart of the 56 control families our questionnaire translator classifies, in ten themes: infrastructure, devices and email 11, governance, risk and people 9 (1 scarce), data handling, privacy and ai 7 (1 scarce), secure development 6 (1 scarce), identity and access 5, assurance and testing 4 (3 scarce), encryption and keys 4 (1 scarce), monitoring and incident response 4 (1 scarce), continuity and availability 3, suppliers and hosting 3. 56control families, 8 of them asking for an artefact mostsmall suppliers do not holdInfrastructure, devices and email11Governance, risk and people9Data handling, privacy and AI7Secure development6Identity and access5Assurance and testing4Encryption and keys4Monitoring and incident response4Continuity and availability3Suppliers and hosting3Answered from records most firms keepScarce artefact
56 control families in 10 themes; the cyan part of each bar is the families that ask for an artefact most small suppliers do not hold. Source: Our security questionnaire translator, read 26 October 2026.

The answer pattern

Four steps: the question as written; what it is reaching for underneath the wording; the record that answers it; and a truthful partial answer that names the exceptions and the date they close. The question as writtenOften a yes or no, in the customer’s own wordingWhat it reaches forThe control underneath the wordsThe record that answers itA policy, a configuration, a report or a logA truthful partial answerWhat is in place, the exceptions, and the date they close
Every family in the translator is answered the same way: name what the question reaches for, hand over the record, and state the gap with its date. Source: Our security questionnaire translator, read 26 October 2026.

What a cyber insurance proposal form asks

Bar chart of the 22 questions in our cyber insurance readiness check by group: identity and multi-factor coverage 3, backups and restoration 3, email filtering and impersonation 3, endpoint protection and detection 3, remote access 2, privileged and administrative accounts 2, patching internet-facing systems 2, supplier and third-party access 2, incident response readiness 2. 22 questionsin 9 groups, the way proposal and renewal forms groupthemIdentity and multi-factor coverage3Backups and restoration3Email filtering and impersonation3Endpoint protection and detection3Remote access2Privileged and administrative accounts2Patching internet-facing systems2Supplier and third-party access2Incident response readiness2
22 questions in 9 groups; identity, backups, email and endpoints carry the most. Source: Our cyber insurance readiness check, read 26 October 2026.

What to do

  1. Build an evidence pack: the security policy, the multi-factor enforcement export, the backup restore record, the administrator list, the incident response plan, the insurance certificates and any certificate or assessment you hold.
  2. Write one master answer for each control family, from the pack, and reuse it in every questionnaire.
  3. State each gap with the date it closes, and keep the dates.
  4. For a scarce artefact, answer with the control you run and its evidence, and never imply the artefact.
  5. Answer the insurance proposal form from the same pack, because the insurer will read it again after a claim.
  6. Review the pack when a control changes, and at least once a year.
  7. Run a questionnaire you have received through our translator before you answer it, to see which families it falls into and which ask for something you do not hold.

Our free tools run in the browser with nothing sent to us: the security questionnaire translator, the cyber insurance readiness check, the Essential Eight check and the penetration test scope builder.

Method

Our security questionnaire translator reads a pasted questionnaire line by line and sorts each question into a control family from a fixed dictionary, most specific first. For each family it states what the question is reaching for, the record that answers it and a truthful partial answer, and it flags the families that ask for an artefact most small suppliers do not hold. It runs in the browser: nothing entered into it is sent to us.

We counted the families and the flags in the tool’s source on 26 October 2026. We group the 56 families into 10 themes, the way a tender response is usually organised. The themes are ours; the families and the flags are the tool’s.

Our cyber insurance readiness check asks 22 questions in 9 groups, grouped the way proposal and renewal forms group theirs. We counted its groups and questions from its source on the same day.

No customer data is in any figure. The counts describe the tools, never what anyone typed into them.

BS-RPT-05, published 26 Oct 2026

The full report, as a PDF

PDF, 8 pages, 279 KB. Tools read 26 Oct 2026.

Download the PDF, PDF, 8 pages, 279 KBTalk to us

More reports