The deal is nearly ready to sign when procurement sends a security questionnaire. One row asks, “Do you enforce multi-factor authentication (MFA) for administrative access?” Sales knows employees use MFA. Engineering knows customer administrators can sign in through their own identity provider. Both facts matter, and the buyer may be asking about either group or both.
Tick Yes only when you can verify that the control operates today across the scope the buyer asked about. If coverage varies by account, plan, region or deployment, spell out where the control applies and who enforces it. Keep planned changes separate from the current answer.
Write down the product, plan, deployment and environment under review. For each question, identify the people, systems or data it covers. A company-wide workforce policy may tell you how staff sign in, while a customer-facing control may depend on the tenant’s configuration.
Check the buyer’s instructions before you reuse an answer. “Supports MFA,” “has MFA enabled” and “enforces MFA” are different claims. For a question about administrative access, ask whether the buyer includes your production operators, their own tenant administrators or both. If the form leaves room for interpretation, state the scope in the answer or ask the buyer to confirm it before submission. Capture the buyer’s clarification alongside the response.
Use these four statuses internally to decide what you can say. They’re a workflow for preparing responses. Follow the buyer’s definitions and answer options when you submit.
If a control is confirmed absent and there’s no approved plan, record it as absent and answer No where that matches the form. If the form only allows Yes or No and coverage is partial, use the buyer’s rules and add the qualification in a comment or a linked response. When there’s nowhere to explain a material exception, ask procurement how to document it before you submit. Use N/A only when the question genuinely falls outside the agreed scope and the buyer’s instructions allow it.
Fictional buyer question. Is MFA enforced for all human administrators of the hosted production service, including your staff and our tenant administrators?
Before
Yes. MFA is enabled.
After
Partial coverage. We enforce MFA for our staff’s administrative access to the hosted production service. For customer tenant administrators using single sign-on, MFA enforcement depends on the customer’s identity-provider policy. MFA is optional for tenant administrators who sign in with a local product account.
Evidence type. A redacted summary of the workforce sign-in policy and a dated test record covering workforce administrative sign-in and both customer administrator sign-in methods. The customer’s identity-provider policy needs separate confirmation for their tenant.
Control owner. Identity and Access Lead.
Last verified. 10 November 2026. The date, role and evidence are illustrative.
Match the evidence to the claim. A policy can show what your team requires. A dated configuration summary and a sign-in test can help show whether a technical control is enforced. For a claim about recurring work, such as quarterly access reviews, an approved record from the latest review shows more than the procedure alone. Before citing a certificate, check the issuing body, validity, legal entity and certification scope against the buyer’s question.
Start with the smallest approved artifact that supports the answer. Before uploading confidential material, check who can access the portal, whether the applicable confidentiality terms cover the disclosure and whether the artifact has its own sharing restrictions. A redacted summary or controlled review may satisfy the buyer. Remove account identifiers, secrets and customer information from anything you share, and get the evidence owner’s approval for the version you send.
Sales can coordinate the response. The control owner should verify technical claims, and the privacy or incident-response owner should check disclosures in their area. Route proposed warranties, notification deadlines, audit rights, deletion commitments and delivery dates to the appropriate contract owner and qualified counsel for review. If the buyer asks whether you’ve had a security incident, confirm their definition, time period and scope before reviewing the incident record and deciding what can be disclosed.
Before submission, check whether the questionnaire is a due diligence record or whether the portal terms, order form, master agreement or security addendum make the response part of the deal. Some procurement terms expressly incorporate vendor responses. Ask counsel to review the effect of the actual terms, including whether the submitted version and any qualifications are captured. Compare any proposed commitment with what the team can deliver and the obligations already in the agreement.
Keep certification, incident history and control claims out of auto-fill. Use the answer library to find a candidate response, then have the responsible owner check the question, scope and current evidence before anyone submits it.
For each reusable entry, store the question and approved wording, product scope, exceptions, internal status, evidence reference, owner, approver and last verification date. Set a review date and reopen the entry when a change affects the claim. A new sign-in method, hosting region or relevant incident can make an approved answer stale before its scheduled review. Save the exact version sent to each buyer, including any clarifications and attachments.
Pull up the last questionnaire your team submitted and pick five answers you expect to reuse. Include at least one broad claim about a control and one answer with a time commitment. Check each against the buyer’s wording and current evidence. Where an answer depends on an assumption, get it resolved or add a qualification before the next submission.
If enterprise buyers are asking for a more formal information security management system, Kooch’s ISO/IEC 27001 readiness support can help you define scope and organise evidence for independent assessment. For recurring reviews of privacy evidence and agreed compliance actions, explore ongoing compliance support.
