Part I · Chapter 1 · The Ask · lesson 5

The two hundred questions, and the three they are really asking

15 min

The spreadsheet has 214 rows. Three columns: the question, a dropdown with Yes, No and Not applicable, and a free-text box headed Comment. There is no cover note. The email says it would be great to have this back by Thursday.

Row 47 asks whether you maintain an inventory of information assets. Row 112 asks whether your data centre has biometric access control. Row 188 asks for your most recent penetration test report. You do not have a data centre.

Before reading on: of those 214 answers, how many will a human being actually read?

Predict

A buyer sends a 214-question security questionnaire. How many of the answers does somebody genuinely read?

All of them — that is why they sent itSomewhere under twenty, and mostly the ones where the answer was not YesNone — it goes in a folderIt depends on the buyer's size

Case file

Composite, not a real person

A twenty-two person analytics company, selling for the first time into a mid-sized insurer. No security hire. The questionnaire landed with the person who had most recently fixed the build.

Nine working days to return 214 rows. The deal's close date was already in a board forecast, and the account executive had described the questionnaire in the pipeline notes as paperwork.

Questions: 214
Days to answer: 7
Answers later found to be untrue: 1
Months before anybody noticed: 11

1Split the spreadsheet across four people by subject, with no shared rule for what Not applicable meant.
2Answered Yes to row 112 on data-centre biometrics, reasoning that the hosting provider had them, and left the comment box empty.
3Answered Yes to whether backups were encrypted and tested, because the platform's documentation said backups were encrypted. Nobody had read one back.
4Answered Not applicable to four rows about physical security, on the grounds that there was no office.
5Attached a vulnerability scan report in place of the penetration test the question asked for, with a one-line comment saying so.
6Returned it in seven days. The deal closed three weeks later.

Eleven months in, a routine support request revealed that a nightly backup job had been failing silently since before the questionnaire was answered. No data was lost, because the primary database had never needed restoring. The insurer's vendor-risk team had the questionnaire on file with Yes against backups tested, and the contract referred to it by name as a representation.

What luck did: The primary database never failed. If it had failed in any of those eleven months, the gap between the answer and the reality would have been discovered by the insurer at the worst possible moment, in a conversation about an outage rather than a support ticket.
Who else tried this: Most companies that answer a questionnaire this way are never caught, because the control they overstated is never exercised. The same four decisions get made across most of the market every week and produce no incident at all, which is precisely why the habit survives and why a near-miss is the only teacher available.
Why it is not a template: This is one composite, assembled to make a mechanism visible. Nothing here says a vulnerability scan is never a reasonable substitute, that Not applicable is usually wrong, or that this insurer's reaction is what another buyer would do. The transferable part is narrow: an answer you have not personally verified becomes a contractual representation the moment the file is attached.

Sorting the 214

Most of the spreadsheet is a procurement function covering itself. That is not a criticism — a buyer who can show they asked has done something real, and a template with 214 rows is cheaper than a team who could write forty bespoke questions. But it means the rows are not all the same kind of object, and treating them as one undifferentiated wall is how the seven-day answer happens.

Not the same thing

A question somebody will act on

A row whose answer changes what the buyer does next, usually because it touches how they would find out, who can read their data, or how they get it back.

Measured in: Whether a No would start a conversation
For example: How quickly would you tell us, and who would you tell, if you discovered unauthorised access to our data?
Chase it alone and: There are only a handful of these, so a vendor optimising for the whole spreadsheet gives them the same two minutes as row 112.

A question covering the asker

A row that exists so the buyer's file shows the question was asked. The answer is filed, not read, unless it is a No.

Measured in: Whether the answer would ever be looked at again
For example: Do you maintain an information asset inventory?
Chase it alone and: Answering these carelessly is still answering them. A Yes you did not verify is a representation whether or not anybody reads it.

Both sides accept
Every row becomes part of the file, and the file gets referenced by the contract. The distinction is about where to spend your attention, never about which rows deserve a true answer.

Which is which? Put each one on a side.

If our data were exposed, how and when would we hear about it from you?
Do you have a documented information security policy?
Which of your own staff can read our data in production, and who decided that?
Does your data centre use biometric access control?
If you went out of business next quarter, how would we keep operating and get our data out?
Do you perform annual security awareness training?

The three on the left are the questionnaire behind the questionnaire. How do we find out. Who can read it. How do we get it back. Everything else is a filter, and the filter is doing a reasonable job of being a filter.

Which suggests a cheap and slightly subversive tactic: answer the 211 honestly and briefly, and then write three paragraphs nobody asked for, covering those three questions, and put them at the top. A vendor-risk reviewer with four hundred vendors and two people has never had that done for them. It also happens to be the fastest way to find out whether your own answers are true.

Check

Row 188 asks for your most recent penetration test report and you have never had one. What goes in the box?

Not applicable, since you have no in-house infrastructureYes, attaching the vulnerability scan — it is the closest artefact you haveNo, with the scan attached, named as a scan, and a sentence on what you do about what it findsLeave it blank and raise it on the call

Worth remembering

A long questionnaire is a filter rather than a study: its function is to produce a short list of answers that are not Yes, which a human then reads.
Three questions carry most of the real signal — how the buyer finds out about an incident, who inside your company can read their data, and how they keep operating if you disappear.
The comment box matters more than the dropdown, because the comments are what gets read.
An answer you have not personally verified becomes a contractual representation the moment the file is attached and the contract names it.
Not applicable is strong when the reason is structural and weak when it is standing in for No.
One overstated Yes costs you the credibility of the other 213 answers, because a reviewer who catches one starts rereading all of them.