It arrives as an attachment: "Please complete the attached security assessment before we can proceed." A big client, a tender, an insurance renewal — and suddenly forty rows of spreadsheet stand between you and the revenue. Here's what each question is actually asking, and what a strong answer looks like.
Security questionnaires have quietly become one of the most commercially important documents a small business fills in. Big companies now vet their suppliers' security because a supplier's breach is their breach; insurers ask because the answers set your premium — and whether you're covered at all. The frustrating part is the language: forty questions that sound like they were written by a lawyer and an engineer having an argument. The good news is that underneath the jargon, almost every questionnaire asks the same ten things.
What are the ten things every security questionnaire asks?
Whether it comes from a client, a tender panel or a cyber insurer, the questionnaire a small business receives nearly always checks ten things: MFA, patching, EDR, backups, incident response, staff training, admin privileges, past incidents, 24/7 monitoring and a named framework (in Australia, usually the Essential Eight). Below, Key IT's security-certified team in Melbourne translates each question and shows what a strong answer looks like.
1. "Is multi-factor authentication enforced on all user accounts, including remote access?"
What they're really asking: can one stolen password sink you? Strong answer: MFA on everything — email, remote access, admin accounts, cloud apps — with no exemptions for directors. "Most accounts" is the answer they're trained to probe, because the exempted account is always the one that gets phished.
2. "Do you have a documented patch management process?"
Really asking: when a vulnerability is announced, how long are you exposed? The word doing the work is documented — "our IT guy keeps things updated" scores zero. Strong answer: defined patch windows with a fast lane for critical, actively exploited flaws — the Essential Eight expects those closed within 48 hours.
3. "Is endpoint detection and response (EDR) deployed on all devices?"
Really asking: if a machine is compromised, does anything notice? Old-style antivirus waits for known bad files; EDR watches behaviour. "All devices" includes the laptop of the person who works from home on Fridays.
4. "Are backups encrypted, kept offsite, and regularly tested?"
Really asking: if ransomware hits, do you pay? One word matters more than the rest: tested. An untested backup is a hope, not a control. Strong answer: immutable copies an attacker can't delete, restores actually performed and verified on a schedule you can name.
5. "Do you have a documented and tested incident response plan?"
Really asking: at 2am on the worst day, does everyone know their job — or do you improvise? Strong answer: a written plan naming who isolates systems, who rings the insurer and your lawyer, and who speaks to clients — and evidence it's been walked through, not just written. Our incident response page covers what a real first hour looks like.
6. "Do staff receive regular security awareness training?"
Really asking: will your people click the link? "We sent an email about phishing once" is not a program. Strong answer: recurring training with simulated phishing, and completion records you can produce.
7. "Are administrative privileges restricted and reviewed?"
Really asking: when an account is compromised, how much does the attacker get? If everyone's an admin, one phished bookkeeper owns the company. Strong answer: admin rights limited to the few who need them, separate from daily-use accounts, reviewed on a schedule.
8. "Have you experienced a security incident in the past 3–5 years?"
Really asking: will you tell us the truth? Counterintuitively, a disclosed incident with a mature response can read better than a suspicious clean sheet. What actually kills deals — and insurance claims — is the undisclosed incident that surfaces later. Answer honestly, always.
9. "Do you have 24/7 security monitoring or a Security Operations Centre?"
Really asking: is anyone watching between 6pm and 8am? Sophos found encryption was deployed outside business hours in 88% of the ransomware cases it investigated. Many small businesses have to answer "no" here. Key IT clients can tick yes, with 24/7 SOC monitoring covering their systems overnight and on weekends. Whichever provider you use, pin down the specifics before you answer: who sees an alert raised on a Sunday night, which of your systems actually feed it, and who is authorised to isolate a machine.
10. "Which security framework do you align with?"
Really asking: is your security a system or a pile of products? For Australian SMBs the expected answer is the ACSC Essential Eight — named maturity level, evidence available. Our 60-second Essential 8 self-check shows which controls you could honestly claim today.
Expect this box to change. On 15 October 2026 the Australian Signals Directorate released ASD Essentials, the framework set to succeed the Essential Eight. Nothing breaks today: the Essential Eight stays on cyber.gov.au through a transition expected to take a year or two, and clients, tender panels and insurers still ask for Essential Eight evidence, so keep answering against it. Your existing work still counts, but if a questionnaire names Essentials, check each control against it rather than assuming it maps across.
Which questionnaire answers get businesses into trouble?
Two kinds of answer do most of the damage: the yes that isn't fully true yet, and the yes you can't back with evidence.
The aspirational yes. Ticking "yes" to MFA-everywhere because it's mostly true, or to "tested backups" because the backups exist. On a client questionnaire that's a contract breach waiting to be discovered; on an insurance proposal it's misrepresentation — the classic ground for a denied claim, discovered at the exact moment you need the policy to pay.
The unprovable yes. The control genuinely exists, but there's no evidence — no policy document, no training records, no restore logs. Questionnaires increasingly come with a follow-up: "please attach evidence." A yes you can't prove is treated as a no, just slower.
What should you answer when you can't tick the box?
Answer honestly, with a date: "Not currently in place — being implemented, complete by [month]." Clients and insurers deal with hundreds of these; a credible roadmap keeps deals and policies alive, because what they're screening for isn't perfection — it's whether you take the question seriously. What kills you is the false yes, or a "no" with no plan attached. And the gaps a questionnaire finds are rarely exotic: they're MFA coverage, backup testing, admin sprawl — exactly the controls a competent provider closes in weeks, not years.
Can your questionnaire answers help you win tenders?
Yes, and that's the reframe worth taking away: every one of your competitors bidding for that client or renewing that policy gets the same spreadsheet, and most will fumble it. With insurers, prime contractors and government buyers now asking for evidence rather than ticks, tender security requirements are becoming a filter, not a formality. A business that answers fast, honestly, with evidence attached, stands out in exactly the way that wins tenders and better premiums. Our clients forward us the questionnaire and get back completed answers with the evidence pack — because we run the controls, the documentation already exists.
Frequently asked questions
What is a vendor security questionnaire?
A vendor security questionnaire, sometimes called a supplier security assessment, is the set of questions a client sends before it shares data or signs a contract, to check your controls meet its standard. A cyber insurance questionnaire works the same way but sets your premium and cover. Both usually ask about MFA, backups, patching, monitoring and the Essential Eight.
Can we answer "yes" now and fix it afterwards?
Don't. On an insurance proposal a false answer is grounds for a denied claim; on a client questionnaire it can be a breach of contract discovered during their audit. An honest "no, with a remediation date" keeps both alive — a discovered false yes ends them.
Who should fill in a security questionnaire?
Whoever runs your IT and security, reviewed by an owner or director who understands the legal weight of the answers. If your IT provider can't fill it in from documentation they already hold, that's a finding in itself.
A tender gave us two weeks. Can gaps be closed that fast?
Some, yes — MFA enforcement, admin-privilege cleanup and backup configuration move in days. Others (training history, tested-restore records) take longer to have honest evidence for, which is why a dated roadmap is the right answer for those rows.
Do questionnaires from clients and insurers ask different things?
They overlap heavily — the ten questions above cover most of both. Insurers push harder on backups, EDR and incident history; big clients push harder on frameworks, data handling and your own suppliers. Same controls underneath.
Should we name ASD Essentials instead of the Essential Eight?
Not unless the questionnaire asks for it. ASD Essentials arrived on 15 October 2026, but the Essential Eight stays current during the transition, and we haven't seen an insurer announce a switch to Essentials. Name your Essential Eight maturity level, attach dated evidence for each control, and watch for new wording about Essentials or priority phases at your next renewal.
What evidence should we attach to our questionnaire answers?
Whatever proves each yes: an MFA enforcement report, patching and vulnerability scan reports, backup restore-test logs, training completion records, your incident response plan and a current Essential Eight maturity assessment. Keep them in one folder and refresh them each quarter, so the next questionnaire is copy-and-attach instead of a scramble.
Can Key IT help us complete a security questionnaire?
Yes. Managed clients forward it to us: because Key IT already runs and documents their controls, we send back completed answers with the supporting evidence. Not a client yet? Call 1300 053 948 and our Melbourne team will work through it with you and flag the gaps, remotely if you're elsewhere in Victoria or Australia.
Wondering how your own business measures up? A free IT & Cyber Security Review shows where you stand and what to fix first — no jargon, no obligation.
Book a Free Review