Start with the actual customer requirement

A typical questionnaire covers MFA, access approvals, backups, incident reporting, suppliers and security policies. Before filling it in, identify which products, services, locations and people the questions relate to.

Five steps to a defensible response

  1. Assign one owner. Nominate the person who will coordinate answers with IT, management and any outsourced provider.
  2. Collect real records. Ask for dated access-policy exports, recent restore-test results, documented response contacts and current procedures.
  3. Separate fact from intention. Use “implemented”, “partially implemented”, “planned” and “not applicable” accurately. A policy written last week isn’t evidence that it has operated for six months.
  4. Record gaps and exceptions. A transparent action plan is safer than claiming every control exists when it hasn’t been tested.
  5. Review disclosure. Redact personal and confidential details, approve customer-facing material and confirm who may sign the final response.

Example: “Do you enforce MFA for privileged access?”

A strong answer identifies the platforms covered, who counts as privileged, how MFA is enforced, what exceptions exist and which configuration evidence supports the answer. “Yes, we use Microsoft 365” is not enough.

What a response pack can contain

  • A completed questionnaire with management-approved responses
  • An indexed list of evidence, including version, date, owner and sharing restrictions
  • A gap and exception register with target actions
  • A short assurance summary explaining the systems included and excluded

APRA and SOCI references need extra care

If your customer is an APRA-regulated entity or operates critical infrastructure, it may ask you to meet certain contractual security controls. That does not, by itself, mean your company has direct duties under CPS 234, CPS 230 or the SOCI Act. Resolve the customer requirement and legal role before making a compliance assertion.

Cyber Evident does not provide legal advice, certifications or assurances that a particular buyer must accept.

Relevant sources