A customer sent us a vendor security questionnaire. What do we do?

A customer's procurement or vendor-risk team has sent you a spreadsheet with somewhere between 40 and 200 questions. It arrived with a deadline. Nobody at your company owns it, and the person it landed on is you.

The reviewer on the other side is not hoping you are perfect. They are checking whether you are a risk they can write down and sign off. That distinction decides how you should answer.

What these questionnaires are actually asking

Almost every questionnaire a Singapore SME receives is a variation of the same eight themes. The wording differs by industry. The substance does not.

• Who is accountable for personal data in your organisation, and can you name them.
• What personal data you hold, where it sits, and which third parties can reach it.
• How access is granted and removed, particularly when someone leaves.
• How long you keep data and what happens when you no longer need it.
• What you would do in the first 72 hours of a data breach, and who you would tell.
• Which sub-processors and cloud vendors you rely on, and what your contracts with them say.
• How staff are trained, and how often.
• Whether you have been assessed by anyone independent, and what that assessment found.

In Singapore, the first five map directly to obligations under the Personal Data Protection Act: accountability, protection, retention limitation, and the data breach notification obligation in force since 1 February 2022. The remaining three are contractual expectations that large customers impose regardless of law.

The three answers that lose deals

Reviewers tell us the same thing. A questionnaire rarely fails on a weak control. It fails on an unusable answer.

• Blank. A blank row cannot be assessed, so it is scored as the worst case.
• "Yes" with nothing behind it. If the reviewer asks for the policy and you cannot produce it that week, the yes becomes a finding about your honesty rather than your controls.
• A long paragraph that never answers the question. This reads as evasion, and it makes the reviewer read everything else more harshly.

How to answer it in one working session

1. 01Read every question first and mark each one green, amber or red. Green means you can evidence it today. Amber means it happens but nothing is written down. Red means it does not happen.
2. 02Fill the green rows and attach the evidence file name in the row itself. Reviewers accept less evidence than you expect, but they need the reference.
3. 03For amber rows, describe the practice in one factual sentence, then state that it is not documented and when it will be.
4. 04For red rows, state the gap, name an owner and give a date. Never invent a control that does not exist. It will be tested later, and by then it is a contractual problem rather than a compliance one.
5. 05Read the whole thing back as the reviewer. Any answer you would query, rewrite.

What to fix first, once the questionnaire is sent

The same questions arrive again from the next customer, usually within a quarter. Fixing them in this order gives the most improvement per hour of work.

• A personal-data inventory: what you hold, where, why, and for how long. Everything else on the questionnaire is answered faster once this exists.
• A data-breach response process on one page, with named roles and the notification thresholds.
• An access list per system, with a removal step in your offboarding checklist.
• A retention schedule and a disposal record.
• A data-processing review of your top five vendors, against what your customer contracts already promise.

That is a few days of focused work, not a project. The reason it does not get done is not difficulty. It is that nobody in a 10 to 200 person company owns it.