Passing a Vendor Security Questionnaire as a Small Supplier

A supplier security assessment is a buyer transferring part of its own risk obligation onto you in writing. Whoever sends it answers to their own auditor, insurer, or regulator, and needs a documented file showing supply-chain diligence.

That tells you what the reviewer wants: not a perfect security program, but defensible answers they can file. A supplier who writes "we do not have this control yet; here is our remediation plan and target date" is easier to approve than one who writes "yes" to everything and cannot produce a screenshot.

Formats vary, but content converges. Most are a variant of SIG or CAIQ, or a buyer spreadsheet mapped to NIST or ISO control families. Answer one thoroughly and you have largely answered the next.

Across defense, energy, healthcare, and financial supply chains, the same clusters carry the weight:

• Multi-factor authentication everywhere - not just email. Buyers ask specifically about VPN, remote desktop, admin accounts, and cloud consoles. Partial MFA is the most common failure point.
• Endpoint detection and response - EDR with active response, not legacy antivirus, covering laptops that leave the building.
• Patch cadence - a stated timeframe for critical patches and evidence you meet it. Vulnerability exploitation was the top breach entry point at 31% in the 2026 DBIR, which is why this one has teeth.
• Logging and retention - what you log, where it goes, how long you keep it. Ninety days is a common floor; a year is increasingly expected.
• Backup testing evidence - not "do you back up," but "when did you last restore, and what did it prove." Untested backups are treated as no backups.
• Incident response plan - named roles and notification timelines, including how fast you would notify them.
• Access reviews - proof that terminated employees lost access and permissions match job function.
• Subcontractor management - who you pass their data to, and whether the same terms flow downstream.
• Cyber insurance - carrier, limits, and whether the policy covers the contracted scope.

The temptation is obvious. The form asks whether you require multi-factor authentication, you have it on Microsoft 365, and "yes" is one keystroke. But the questionnaire is the beginning of a chain, not the end of one. Answers get sampled. Contracts get audited. Insurance claims get investigated.

The clearest public illustration is Travelers v. International Control Services. After a 2022 ransomware attack, the insurer sought rescission of a $1 million cyber policy, alleging the application overstated MFA deployment - its filing asserted MFA protected only the firewall, not the server attacked. In August 2022 the parties stipulated to a judgment voiding the policy from inception. The loss was real; the coverage evaporated over an application answer.

A vendor questionnaire carries the same structural risk, only the counterparty is your customer. A false attestation that surfaces during an incident turns a security event into a contract-breach conversation. Write the truth, then write the plan.

These feel crushing because most small suppliers treat each one as a fresh research project. Build the underlying artifacts once and every future assessment becomes copy-paste plus a few custom answers. A working evidence pack contains:

• An asset inventory - endpoints, servers, cloud tenants, network gear, with owners. Nearly every other answer depends on it.
• A written information security policy - short is fine. Ten pages that reflect reality beat forty copied from a template.
• An incident response plan with a contact tree and stated notification windows.
• MFA coverage report from your identity provider, showing enrollment by application.
• Patch compliance report from your RMM tool for the trailing 90 days.
• Backup restore test records - dates, what was restored, how long it took, who signed off.
• Access review records - quarterly is the usual expectation.
• Security awareness training completion rates and phishing simulation results.
• Certificate of cyber insurance and a current network diagram.

Keep these in one folder with a refresh date on each. This is the documentation an IT consulting engagement should leave behind, and what makes a formal audit survivable later. If your provider cannot produce a patch compliance report on request, that is a signal - our guide to switching IT providers covers evaluating that without disrupting operations.

If any of your revenue touches a Department of Defense contract, the questionnaire is backed by regulation rather than preference. CMMC Level 2 requires all 110 security controls in NIST SP 800-171. The DFARS final rule integrating CMMC through clause 252.204-7021 was published September 10, 2025 and took effect November 10, 2025 on a phased schedule.

What small suppliers miss is flow-down. Primes must pass CMMC requirements to lower-tier subcontractors that store, process, or transmit Federal Contract Information or Controlled Unclassified Information, and must confirm their subs hold the required status. You can be four tiers removed from the government and still be in scope. The timeline has seen adjustments, so confirm current requirements with your contracting officer rather than a blog post, including this one.

Outside defense there is no single certification, but the commercial pressure is comparable and the data is worse. A SecurityScorecard and KPMG study published in October 2024, examining the 250 largest energy companies, found third-party risk drove 45% of breaches in the U.S. energy sector against a 29% global rate, and that 90% of energy companies with multiple breaches had issues traced to third-party vendors.

For operators along the I-45 corridor, that translates directly into supplier questionnaires landing on machine shops, inspection firms, logistics companies, and engineering consultancies - a large share of the market for managed IT services in The Woodlands.

Healthcare has its own version. A business associate must obtain written assurances from any subcontractor handling electronic protected health information, and those agreements must meet the same standard as the original BAA. Proposed HIPAA Security Rule updates would convert MFA and encryption from "addressable" to required, though the final rule is still pending - treat the direction as certain and the date as not.

Sequence matters more than speed. In the right order, each step makes the next cheaper. In the wrong order, you buy tools you cannot operate.

• 1. Inventory first. You cannot attest to assets you have not counted. Two days of work that unblocks everything else.
• 2. MFA on everything. Email, VPN, remote access, admin accounts, cloud consoles. Highest-return control, most-asked question.
• 3. Remove local administrator rights and stale accounts. Free, and it collapses the blast radius of everything else.
• 4. Deploy EDR with monitoring behind it. Nobody watching the alerts answers the questionnaire but not the risk.
• 5. Establish a patch cadence and start producing the report. The report is the deliverable.
• 6. Centralize logging with defined retention.
• 7. Test a restore and document it. Then schedule the next one.
• 8. Write the incident response plan and walk it through once with the people named in it.
• 9. Formalize access reviews on a quarterly calendar invite.
• 10. Revisit cyber insurance with accurate answers now that the controls are real.

Steps two through six are where cybersecurity services and managed IT services overlap almost entirely. Most of what a questionnaire demands is competent IT operations with the paperwork turned on. Automated monitoring runs around the clock; the humans reviewing findings work business hours with after-hours emergency response.

The figures below are published regulatory and market data, cited so you can size the problem. They are not LayerLogix pricing and are not a quote.

The Department of Defense published cost modeling in the CMMC regulatory impact analysis, estimating a Level 2 certification assessment at roughly $101,752 for a small entity, including about $31,234 in assessor fees, and a Level 2 self-assessment with its affirmations at over $37,000. Those cover assessment only - DoD assumed control implementation was already contractually required.

Commercial questionnaires carry no assessor fee, so the cost is internal: staff hours, tooling, remediation. That spend is front-loaded. The first questionnaire is expensive because you are building the evidence pack; the fifth is cheap because you are updating dates. Predictable monthly structures such as flat-rate IT services fit this better than hourly billing, since compliance evidence is continuous rather than episodic.

Someone has to sign it, and that should not be whoever opened the email. Assign one internal owner - usually operations or whoever signs contracts - to hold the evidence pack and coordinate answers.

Suppliers with one internal IT person often split the work: internal staff keep operations running while an outside partner supplies security tooling, documentation, and evidence production. That is the normal shape of co-managed IT, and it suits questionnaire work because the internal person knows the business context while the partner knows what the reviewer is actually asking. When a buyer sets a hard deadline, fast-response IT support matters more than usual.

If a questionnaire is already on your desk, work in this order:

• Read the whole document first. Separate questions needing evidence from simple yes or no, and request an extension in writing if you need one. Buyers grant them far more often than suppliers ask.
• Answer what is true today and mark the rest as gaps with dated remediation plans. Partial credit is real; discovered false statements are not survivable.
• Start the evidence pack with the four items reviewers request most: MFA coverage, patch report, restore test record, incident response plan.
• Fix MFA gaps immediately, ideally before the response is due. It is the fastest control to close and the one most likely to be independently verified.
• Get an outside read. Our free IT assessment takes three questions and maps your posture against what buyers commonly require.

If none has arrived but you sell into energy, defense, healthcare, or financial services, assume one is coming and build the pack on your own schedule. Suppliers who prepare answer in days; suppliers who start when the email lands answer in weeks, badly. You can also contact our team at 713-571-2390 to walk through one you have received.

How long does a vendor security questionnaire take to complete?

A first-time response to a 150 to 200 question assessment typically takes 20 to 40 hours of internal effort over two to three weeks, most of it spent locating evidence rather than writing answers. Once the evidence pack exists, later questionnaires often take a few hours.

Can I answer yes if a control is planned but not implemented?

No. Answer no, then attach a remediation plan with a target date and owner. Reviewers routinely approve suppliers with documented gaps and reject those whose answers cannot be substantiated. An overstated answer that surfaces during an incident puts both the contract and your insurance coverage at risk.

What is the difference between a questionnaire and a security audit?

A questionnaire is self-reported and reviewed on paper. An audit involves an independent assessor verifying evidence directly, sometimes on site. Questionnaires often screen for whether a buyer escalates you to a formal audit, so your answers become the checklist the auditor later tests.

Does my small company really need cyber insurance to pass?

Increasingly yes, because many buyers set a minimum coverage limit as a contractual condition rather than a security question. The application also asks the same control questions the questionnaire does, so accurate answers in one place keep you consistent in the other.

What if my IT provider cannot produce the evidence I need?

Common and fixable. Ask specifically for an MFA coverage export, a 90-day patch compliance report, and a documented restore test. If those cannot be produced within a week, the gap is in reporting and process, and it is worth evaluating whether your support arrangement matches what your customers now demand.

LayerLogix supports Texas suppliers facing third-party risk assessments statewide, with 20+ Years Experience and 100% Texas-Based Support. We work with manufacturers, service firms, and engineering companies across The Woodlands, Houston and the greater Houston area including outsourced IT support in Houston, and north into Dallas and DFW. Call 713-571-2390 for the Houston region or 888-792-8080 statewide.