Connect the request to the service you sell
A security questionnaire often arrives when a sales opportunity already has a deadline. Before answering, identify which service the client is assessing and what information they will entrust to you. A question about backups needs an answer tied to that service, rather than a general statement about the whole company.
Define the people, processes, systems and suppliers involved. This boundary helps you establish the scope of your security management system and avoids answers your team cannot substantiate. Share the scope with sales so that proposals and contracts stay consistent.
Organize the risks before collecting documents
Identify what could compromise the confidentiality, integrity or availability of the service’s information. Consider how people access it, where it is stored, who changes it and which third parties it depends on. Assess risks using criteria that let you compare priorities.
For each significant risk, agree on its treatment, its owner and the evidence that will demonstrate progress. ISO/IEC 27001:2022 requires a risk management approach. Its statement of applicability documents the necessary controls and justifies inclusions and exclusions against the reference controls.
Link every answer to a practice you can verify
A policy explains what the company intends to do; a record helps demonstrate what it has done. For access management, for example, gather authorizations, reviews and access removals according to your process. For incidents, retain notification criteria, assigned responsibilities and response records where applicable.
Create a simple table with the client’s question, the approved answer, its owner and the available evidence. If a practice is missing, record the gap and how it will be addressed. Avoid claiming that a control operates continuously when you only have a document or an isolated activity.
Maintain a useful repository and protect what you share
Use your company’s current tools to manage versions, permissions and ownership. Define which evidence you can share and which needs confidentiality safeguards or prior review. Sharing sensitive information without controls to demonstrate security can introduce a new risk.
Review the repository whenever services, suppliers or controls change. A system aligned with ISO 27001 organizes this continuity and can prepare you for independent certification within its scope. A certificate does not guarantee the absence of incidents: the value lies in managing risks, responding and improving with evidence.
For your next meeting
Your preparation checklist.
- Confirm the service and information the client is assessing.
- Define the scope, responsibilities and relevant suppliers.
- Connect risks to controls and treatment decisions.
- Assign verifiable evidence to every sales response.
- Review permissions and conditions before sharing documentation.
This guide provides general orientation. The official standard and your company’s scope determine applicable requirements.
Consult the official ISO reference
