Security questionnaire: do it yourself, use a tool or outsource?
Doing it yourself fits when you get few questionnaires and someone in-house has the time and knowledge. A tool fits when you get many and someone maintains the answer library. Outsourcing fits when a deal is waiting, you get a few a year or the questions are about regulation. Many companies combine: outsource first, add a tool later.
There are three ways to get a customer questionnaire done. None of them is always best. Below you see for each option what it costs, who does the work and where it can go wrong.
The three options side by side
| Do it yourself | Tool or software | Outsource | |
|---|---|---|---|
| What you pay | Internal hours | A subscription, plus internal hours to maintain answers | Per questionnaire or per period |
| Who does the work | Your own team, often the CTO or developers | Your own team, helped by the software | An external party; you provide documents and review |
| Speed the first time | Depends on who has time | Slow: the library has to be filled first | Fast: capacity is available straight away |
| Speed after that | A bit faster, if you can find old answers | Fast, if the library is current | Fast, especially with kept answers |
| Biggest risk | Over-optimistic answers under time pressure | Old or auto-generated answers that are no longer true | A party that answers without looking at your evidence |
| Fits | An occasional short list | Dozens of questionnaires a year and an in-house security or compliance role | A few to a few dozen a year, or when a deal is waiting now |
Doing it yourself
The cheapest on paper. But the hours usually go to the most expensive people in your company, and the deal waits while they have no time. The biggest risk is not speed but quality: under time pressure, “we are working on it” quickly becomes “yes”. Use the calculator to see what a questionnaire costs you internally.
A tool or software
Questionnaire tools keep your answers in a library and suggest answers for a new list, increasingly with AI. That works well if you get many questionnaires and someone keeps the library current. The pitfall: a tool does not know whether your policy is still valid or whether your penetration test is from this year. You still need to check a suggested answer against your evidence.
Outsourcing
An external party completes the list based on your documents. That is fast and takes the work off your team. Do check how they work: do you get a source for every answer, and are missing points named honestly? If not, you are mainly buying nice sentences. Read how outsourcing works or see an example completed questionnaire.
Five questions to decide
- How many questionnaires did you get last year, and how many do you expect next year?
- Who completes them now, and what would that person do with the time instead?
- How often does a deal wait on a questionnaire?
- Is your evidence in order: current policies, a recent penetration test, documented procedures?
- Are the questions increasingly about NIS2, DORA, GDPR or AI?
Few questionnaires and evidence in order: do it yourself. Many questionnaires and an in-house compliance role: a tool. In between, or when a deal is waiting now: outsource.
Frequently asked questions
Can AI complete a security questionnaire?
AI can suggest answers based on earlier answers or documents. But AI does not know whether those documents are still true. You need to check every answer against current evidence before it goes to your customer.
When is a tool worth it?
When you get many questionnaires a year and have someone who maintains the answer library. Without that person, the library quickly goes out of date.
Can I outsource first and add a tool later?
Yes. A well-completed questionnaire with sources is a good start for an answer library, in a tool or in your own document.
What does outsourcing to Holdvero cost?
Up to 150 questions €695 (Questionnaire Rescue). Larger lists, portals and tenders from €1,195. Prices excl. VAT.
Want to know what it costs for your questionnaire?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price