Outsourcing a security questionnaire: how it works
Outsourcing means someone else completes the questionnaire based on your own documents. You provide the questionnaire, your existing policies and a contact person. You get back a completed version with a source for every answer and a list of open items. You review it and decide what goes to your customer.
A customer questionnaire is waiting, the deal is on hold, and nobody on your team has time for it. You can keep doing it yourself, buy a tool or outsource it. This page explains what outsourcing means in practice, so you know what to expect.
When outsourcing pays off
- A deal depends on it. The customer is waiting and a week's delay costs more than the work itself.
- The work lands on the wrong people. Your CTO or lead developer spends days in a spreadsheet instead of on the product.
- You get a few a year. Too many to ignore, too few for a compliance hire or a tool.
- The questions are about regulation. NIS2, DORA, GDPR or AI: you want to know what the customer really asks before you say yes.
Not sure? Compare the options in do it yourself, use a tool or outsource, or use the calculator to see what a questionnaire costs you internally.
What you provide
- The questionnaire itself, in the form you received it: spreadsheet, Word, PDF or access to a portal.
- What you already have: policies, procedures, previously completed questionnaires, certificates, penetration test reports, your data processing agreement.
- One contact person who can answer questions about how things work in practice.
- Your customer's deadline.
Confidential documents are only shared after an NDA, using the method agreed for each engagement. More on our Security and data page.
What you get back
- The completed questionnaire, in your customer's format.
- A source for every answer: which document, which section, or which explanation from your contact person.
- Open items instead of guesses. Where evidence is missing, there is no “yes” but an honest wording and what is needed to close the gap.
Want to see what that looks like? Look at the example completed questionnaire (fictional company, download straight away).
How it runs
- You send the questionnaire. Within 1 working day you hear the price and when you will get it back.
- Intake. We agree which documents are needed and how you share them.
- Completion. We answer each question based on your documentation and ask where something is unclear.
- You review. You go through the answers and open items and decide what goes to your customer.
What it costs
| Situation | Service | Price (excl. VAT) |
|---|---|---|
| Up to 150 questions: security, privacy, NIS2 or AI | Questionnaire Rescue | €695, 3–5 working days after complete intake |
| Larger, a portal or a tender | Complex questionnaire | from €1,195, fixed price after a short check |
| Reviews keep coming | Evidence Maintenance | custom |
You only pay after agreeing to the price.
What outsourcing is not
- No invented answers. What you have not arranged is not written up as better than it is.
- No certification. Holdvero does not provide ISO 27001, SOC 2 or any other certification, and no legal advice.
- No transfer of responsibility. You remain the supplier giving the answers to your customer.
Frequently asked questions
Can I outsource a security questionnaire without ISO 27001?
Yes. The answers then show with policies, procedures and evidence how you have arranged things. See also questionnaire without ISO 27001.
How much of my time does it still take?
The intake, answering a few clarifying questions, and the review at the end. The searching, wording and linking to evidence is done by us.
What if the customer uses a portal instead of a spreadsheet?
That works. Portals usually fall under the complex questionnaire, because they often contain more questions and attachments.
Can you talk to the customer?
No. You remain your customer's point of contact. We do prepare you for follow-up questions on the open items.
How fast can it be done?
Questionnaire Rescue takes 3–5 working days after complete intake. If your deadline is tight, mention it when you send it in and you will hear straight away whether it is feasible.
Outsource your questionnaire?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price