Answer guides · 42 questions
How to answer security questionnaire questions
Every vendor security questionnaire asks the same few dozen things in different words. Each guide below takes one of those questions and explains what the buyer is trying to find out, the other ways it gets asked, and the evidence to have ready. Start with the topic in front of you.
- Describe your data encryption at rest strategy.
- What protocols and standards are used for data in transit encryption (e.g., TLS 1.2+)?
- Describe your cryptographic key management: generation, rotation, revocation, and destruction of keys.
- How do you manage and rotate encryption keys?
- Can customers supply, manage, or revoke their own encryption keys (BYOK or customer-managed keys) for the data you hold on their behalf?
- How do you manage secrets including API keys, credentials, and certificates?
- How do you isolate data between different tenants or customers?
- Describe your data retention and destruction policies.
- How do you classify and label data?
- Where do you store sensitive/regulated data?
- Which groups of personnel (employees and contractors) have access to personal and sensitive data?
- How do you mask, anonymize, or tokenize sensitive data in non-production environments?
- Describe your multi-factor authentication (MFA) implementation.
- Do you support Single Sign-On (SSO) or SAML integration?
- Do you implement the least privilege principle for system access?
- How do you implement role-based access control (RBAC)?
- How do you handle privileged access management (PAM)?
- What is your process for user access provisioning and deprovisioning?
- How frequently are access rights reviewed?
- How do you manage user authentication and authorization?
- Describe your password/credential policies (length, complexity, rotation).
- How are user passwords stored and protected (hashing algorithms, salting)?
- How do you monitor and review access logs?
- Describe your secure development lifecycle (SDLC).
- How do you conduct code reviews?
- What application security testing do you perform (SAST/DAST)?
- Is security testing automated in your CI/CD pipeline?
- How do you manage open source components and dependencies (SCA)?
- How do you manage application vulnerabilities?
- How is threat modeling incorporated into your design and development process?
- Is application deployment automated with proper controls?
- Describe your API security controls.
- Do you implement API rate limiting to prevent abuse?
- How do you securely store and manage API keys?
- Does your application support IP allowlisting for user authentication or API access?
- Describe your incident response plan (IRP).
- What is your SLA for notifying customers of a security breach?
- Describe your breach notification procedures.
- How do you detect security incidents?
- How long do you retain security logs?
- What is your SIEM strategy?
- How are the clocks of your processing systems synchronized to a reliable and auditable time source?