A customer has sent a security questionnaire. Which answers can you prove?

Do you have a written information security policy, approved by a director and reviewed in the last 12 months?

One document that says how the business keeps its systems and data secure, who is responsible, and what it aims for. Questionnaires usually ask for a copy.

Have you written down your security risks and what you are doing about each, in the last 12 months?

A list of what could go wrong, how likely and how bad each is, and the decision on each: fix it, reduce it or accept it, with who decided.

Has every member of staff had security awareness training in the last 12 months, with a record of who did it?

Phishing, passwords, reporting something suspicious. A record means names and dates, not a slide deck.

Are people with access to customers' systems or data background-checked before they get that access?

References and identity at least, set by role. Answer yes only if it is done for every such role, and recorded.

When somebody leaves, is their access removed and their devices and data returned or wiped, on a checklist that is kept?

Every account, including the cloud services and the shared logins, on the day they go.

Is two-step sign-in required on every staff account, email and remote access included?

A code or an app prompt as well as the password, enforced for everybody. Switched on for those who chose it does not count.

Do administrators use separate admin accounts, with two-step sign-in, kept for admin work only?

The account that can change settings or reset passwords is not the one used for email and browsing.

Is access to systems and customer data given only to those who need it, and reviewed at set times, suppliers' access included?

A review means somebody looks at who has access to what and removes what is no longer needed, and the date is kept.

Do you keep an up-to-date list of your devices, systems and the software and cloud services you use?

What you run, who owns it and what it holds. Questionnaires ask which of these hold their data.

Are security updates applied within a set time after they come out, and is that recorded?

Laptops, servers, phones, and the software you run. A set time means a written target for each severity of update.

Does every laptop and server run up-to-date protection against malware, such as endpoint detection and response?

Endpoint detection and response (EDR) watches a device for attacks and can isolate it. Most cyber insurers now ask for it.

Do you scan for vulnerabilities at set intervals, keep the results, and fix critical ones without delay?

Scans of what faces the internet, at least: your website, your email set-up and anything else reachable from outside.

Has an independent firm tested the security of what you supply (a penetration test) in the last 12 months?

If you sell software or a hosted service, customers often ask for the latest test report or a summary of it.

If you build software, do you follow written secure development rules, with security testing before each release?

Answer yes if you build no software. If you do: code review, dependency checks, testing, and who signs off a release.

Is customer data encrypted when it travels and where it is stored, under a written rule?

HTTPS on your website and app, encrypted email delivery, and encryption in your databases, laptops and backups.

Are backups kept apart from your main systems, so an attack on those cannot reach them?

A copy offline, or in a separate account or service the main systems cannot change or delete.

Have you restored data from a backup as a test in the last 12 months, and kept the dated result?

A green backup light shows that a job ran, not that the files come back.

Do you have a written plan for keeping the service running, or getting it back, if a key system or supplier fails?

Who decides, who is told, the order things come back in, and how long customers can expect to wait.

Do you have a written plan for a security incident, practised at least once with the people it names?

Who does what in the first hours of a hacked mailbox, ransomware or a lost laptop, and who you must tell.

If an incident affects a customer, can you tell them without delay, through a named contact and a set route?

A customer under NIS2 has its own clock: an early warning to the authorities within 24 hours. It needs to hear from you first.

Is your email domain set so that mail forged in your name is refused or sent to spam (SPF, DKIM, and DMARC set to enforce)?

DMARC at p=none only reports; it stops nothing. The free email security check on this site reads yours from public DNS.

Where you handle personal data for customers, do you keep the written record of that processing the GDPR asks a processor for?

For each customer: the kinds of processing, any transfers outside the EU, and the security measures. Answer yes if you handle no customer's personal data.

Can you say in which countries customer data is stored and processed, and list every sub-processor and subcontractor that handles it?

Your hosting, email, support desk, analytics and any contractor. Customers ask to be told before any of these changes.

When a contract ends, can you return or delete the customer's data, and show that you did?

Including the copies in backups, test systems and suppliers' systems.

Can you give a customer independent evidence of your security: a certificate, an audit report, or a dated evidence pack?

An ISO 27001 certificate covers only its stated scope. A cloud provider's certificate is evidence about the cloud provider, not about you.