Sylvan Assurance Questionnaire Readiness Check · Free

A customer sent you a security questionnaire. How ready are you to answer it?

Ten plain-English questions about the things security questionnaires actually ask for. You get a score, a readiness band, and a plan — in about three minutes.

No email required · Runs in your browser · Free

1. Do you have a written security policy?

Almost every questionnaire asks for this first — a document that says how your business handles security, even if it is only a few pages.

Yes — written down and reviewed Partially — informal or out of date No, or not sure

2. Is two-step login turned on for your important accounts?

Two-step login (a code or prompt on top of the password) for email, admin accounts, and anything that reaches customer data. Reviewers usually ask whether it is required, not just available.

Yes — required on email, admin, and remote access Partially — on some accounts, or optional No, or not sure

3. Do you have a written plan for what happens when something goes wrong?

A short incident plan: who is in charge, who you call, and what you do first. Reviewers ask to see the document, not just hear that you would cope.

Yes — written down, with named people Partially — we know roughly what we would do No, or not sure

4. Do you back up your important data — and have you tested getting it back?

Questionnaires increasingly ask for proof that a restore actually works, not just that backups run.

Yes — backups run and we have tested a restore Partially — backups run but never tested No, or not sure

5. Do you keep track of the other companies and tools your business relies on?

A list of your key vendors and online services, and a basic check on how they handle security. Buyers ask how you manage your own suppliers.

Yes — a written list with basic security checks Partially — we know who they are, nothing written No, or not sure

6. Do you know what customer data you hold, and where it lives?

A simple inventory: what data you collect, where it is stored, and who can see it. Many questionnaire answers start from this one document.

Yes — written down and reasonably current Partially — in our heads, not on paper No, or not sure

7. Does everyone on your team get basic security training?

Even a short yearly session on spotting scam emails and handling data counts — as long as it actually happens and you can say when.

Yes — regular, and we can show when it happened Partially — informal or one-off No, or not sure

8. Do you hold any security certification or independent audit?

For example SOC 2 (System and Organization Controls 2) or ISO 27001 (the international information-security management standard). "Not yet" is a common answer — what matters is answering it well.

Yes — we hold one, or an audit is under way Partially — planned or budgeted, not started No, or not sure

9. Have you answered a customer security questionnaire before?

Past answers are reusable. If you have been through one, you likely have wording you can adapt instead of starting from a blank page.

Yes — and we kept our answers Partially — once, but we did not keep much No, or not sure

10. Is one named person responsible for security at your business?

Questionnaires ask who owns security. It does not need to be a full-time role — it needs to be a name, not "all of us."

Yes — a named owner, written into their role Partially — someone handles it informally No, or not sure