Procurement and security receive longer surveys: NIS2, DORA, ISO, privacy, AI. Without structure you get copy-paste with contradictory answers — visible in audits and due diligence.
Build an answer library
- standard answers with owner, version and review date;
- evidence attachments (certificate, SoA summary, pentest summary);
- escalation to CISO/legal when answers affect scope;
- mapping: which question ties to which ISMS control.
Questionnaire process
- Intake: deadline, customer, product/service scope.
- Match questions to library — no rewriting from scratch.
- Control owner review before send.
- Log commitments — contracts sometimes follow the questionnaire.
More: vendor management and audit evidence.
In 2026 questionnaires often include NIS2 and DORA questions alongside ISO 27001. Tag answers in your library per framework so you do not copy a NIS2 answer into a pure ISO programme with different scope definition.
Version control is crucial: date of last review and who approved the answer. Due diligence teams compare answers over time — inconsistency between two questionnaires in the same month is a common issue.
Link questionnaire commitments to contract and risk register. If you promise 24/7 incident notification in a survey, that must appear in operations and contracts — auditors follow that chain.
Align sales, legal and security
The fastest route to contradictory answers is letting sales complete a questionnaire while security answers the same questions differently for another customer months later. Agree that every submitted survey has at least one reviewer from security or compliance, and that deviations from the library are always explained in the log.
Keep a simple register: customer, date, library version, reviewer and any exceptions. Due diligence teams increasingly ask for this. It does not need a heavy GRC platform — a shared spreadsheet with fixed fields and links to attachments is enough for many SMEs, provided version and owner are clear.
When you cannot use a standard answer because the customer demands more, treat it as a contract and risk decision: can you deliver that promise with current operations? If not, escalate before sending. Auditors and procurement follow the chain from questionnaire to contract and incident response.
Each quarter, review your ten most-used answers. Patch policy, log retention and AI use change quickly — stale standard text is worse than a longer turnaround.
Import questionnaires into one working file per customer where possible, so you see which questions are new versus prior rounds. Only new or changed questions need a library update — that keeps the set manageable. Share an internal FAQ for sales: which questions always go to security and which standard answers they may use.
Note: this article is educational and does not replace legal, privacy or audit advice for your specific situation.