A customer's security questionnaire is addressed to your organisation. So each yes is your statement, even when it repeats what your IT provider tells you. The useful work is to separate what you can stand behind from what you are relaying.
When a client asks for proof of cyber security, sort each answer by what supports it
Put every technical answer into one of four groups. Reported: the provider says it is in place. Record supplied: you have received a report, export or screenshot. Check performed: someone compared two specific things, and you note who and the narrow result. Unknown or outside agreed scope: nobody has answered yet, or nobody has confirmed who owns it.
Receiving a record does not authenticate it or prove it is complete. Write that the record reports a state, not that it shows what is true.
What to ask your provider for
The Canadian Centre for Cyber Security's top measures guidance for small and medium organizations suggests starting with four controls: an incident response plan, patching operating systems and applications, strong user authentication, and backing up and encrypting data. If your questionnaire asks about these areas, they are a sensible place to begin your requests.
Scope matters as much as the yes. The Cyber Centre's baseline controls recommend that organizations list which systems are in scope and give the rationale for any they exclude. The same guidance recommends documenting each case where an organization decides not to use two-factor authentication.
How to word exceptions and uncertainty
Follow the questionnaire's own instructions first, and ask the customer if the format is unclear. Where an answer rests only on the provider's report, consider saying so, for example: reported by our managed IT provider, supporting records requested. Where a control covers some systems, name them and name the exclusions.
In this hypothetical example, the provider reports that two-factor authentication is on for all staff, and the supplied export lists staff email accounts but names no administrator accounts. Comparing that export with your staff list checks only which names appear on it. It does not establish how sign-in is configured, so the administrator accounts become a question to ask, not a finding.
What the gaps can and cannot tell you
A missing record does not by itself mean a control is absent. A slow reply is consistent with several explanations, such as workload, an unclear request or records held by another party, so its cause stays unresolved. For each item, record the provider's explanation, what you compared, whether a corrected record was promised or received, and which questions remain open.
Then decide what the open items mean for you. One questionnaire answers only the questions it asked. Bring the list of open items to your next conversation with the provider, and weigh it alongside everything else you know when deciding whether to keep, improve, renew or replace the arrangement.
For a similar exercise on insurance forms, see checking who verified your cyber insurance questionnaire answers. If you want an outside view of the records your provider supplies, see the actually. review.
actually. offers an independent review of evidence about your existing IT provider.
The review is a paid service.