9 mistakes in security questionnaire answers
Many problems with security questionnaires are not caused by a missing control, but by an answer that says more than the evidence supports. Watch out for absolute words, a scope that doesn't match, stale evidence, contradicting answers, new promises, legal claims, plans presented as fact, policy without practice and behaviour nobody has tested. Check every important answer against these nine points before you send it.
A buyer often reads your answers side by side and asks follow-up questions where something doesn't add up. A “yes” that turns out to be wrong at the first follow-up costs more trust than an honest “partly”. Below are nine mistakes, each with an example and a better version. The examples are made up.
1. Absolute words
Words such as always, never, all, fully or 100%. They sound strong, but one exception makes the answer untrue.
- Avoid: “All data is always encrypted.”
- Better: “Customer data is encrypted at rest and in transit (TLS 1.2 or higher). See our security policy, section 2.”
What to do: Make the statement as narrow as your evidence, or get evidence that covers the whole statement.
2. A scope that doesn't match
The question is about the whole company, your evidence only about production. The question is about all staff, your evidence only about administrators.
- Avoid: “Question: Do all your employees use MFA? Answer: Yes.”
- Better: “Partly. MFA is required for the cloud console and email. For the support tool it follows by 1 December.”
What to do: State the scope in your answer. If it does not match the question, “partly” is the honest answer.
3. Stale evidence
A penetration test report from two years ago, an expired certificate or a policy that describes an old situation.
- Avoid: “We have an annual penetration test. (Latest report: March 2025.)”
- Better: “The latest penetration test was in March 2025. The next one is planned for November 2026.”
What to do: Update the evidence, or state the date honestly.
4. Contradicting answers
Two answers in the same questionnaire say different things. Or your answer differs from your policy, your website or an earlier questionnaire for the same customer.
- Avoid: “Question 12: daily backups. Question 40: weekly backups.”
- Better: “Both answers: daily backup of the database, weekly backup of files.”
What to do: Keep one place with approved answers and use it everywhere.
5. A new promise
An answer promises something that is not in your contract or your way of working: a shorter deadline, an extra control, a date.
- Avoid: “We fix critical vulnerabilities within 24 hours. (Patch policy: within 7 days.)”
- Better: “We fix critical vulnerabilities within 7 days of discovery, as set out in our patch policy.”
What to do: Only promise what your contract and practice support. If you want to promise more, decide that deliberately and record it.
6. A legal or compliance claim
Phrases such as “we are GDPR compliant”, “we comply with NIS2” or “ISO 27001 compliant” without a certificate. That is a legal judgement or a certification, not a fact you can show with a document.
- Avoid: “We are fully GDPR compliant.”
- Better: “We keep a record of processing, have a data processing agreement with every sub-processor and a data breach procedure.”
What to do: Describe your measures, with evidence. Only mention a certificate with its scope and validity.
7. A plan presented as fact
Something planned is written in the present tense. “We have SSO”, while it only goes live next quarter.
- Avoid: “We support SSO via SAML.”
- Better: “SSO via SAML is planned for the first quarter of 2027. Today: email and password with mandatory MFA.”
What to do: Present tense only for what exists today. Mention planned work as a plan, with a date.
8. Policy without practice
The policy says it, but does it happen? “Access rights are reviewed every quarter” is only strong with a record of the latest review.
- Avoid: “Access rights are reviewed every quarter. (Evidence: the policy only.)”
- Better: “Access rights are reviewed every quarter. The latest review was on 2 September 2026.”
What to do: Find operational evidence: a record, ticket, export or screenshot. See the evidence ladder.
9. Behaviour nobody has tested
The claim is about what a system does, often an AI feature. “The chatbot never reveals data of other customers.” Policies and design documents only show the intention.
- Avoid: “Our AI assistant never shares data of other customers.”
- Better: “Each customer has a separate environment and search filters by customer. The assistant's behaviour has not yet been tested separately.”
What to do: Describe the control, not the behaviour, until the behaviour has been tested.
Three questions before you send
- If the buyer asks for evidence, can you show it within one working day?
- Would the owner of the answer send this with their name under it?
- Is there no certification, legal judgement or guarantee in it that you cannot support?
How Holdvero helps
With Questionnaire Rescue we check every answer against these nine points before we deliver it, and link it to your own evidence. Where evidence is missing, we write an open item instead of a “yes”. You remain the owner of your answers and decide what you send. Holdvero does not provide certification or legal advice.
Unsure about a few questions? With the free Deal Review we look at up to 10 of them, within 2 working days. Prefer to do it yourself? Use the free Open Evidence Pack.
Frequently asked questions
Isn't “partly” bad for the deal?
Usually not. A buyer does not expect everything to be perfect. They want to know where they stand. An honest “partly” with a plan and a date is stronger than a “yes” that later turns out to be wrong.
Can I write that we are GDPR compliant?
Better not. Whether you comply with the GDPR is a legal judgement. Describe what you have in place and show the evidence.
How do I avoid contradicting answers?
Keep one place with approved answers and the evidence behind them, for example the free Open Evidence Pack. Use it for every new questionnaire.
What do I do with a question about AI behaviour?
Describe the controls you have, and say honestly whether the behaviour has been tested. Important claims can be tested, for the version and settings you use.
Want a second look at your answers?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price