# How to answer a client’s security questionnaire. No guesswork. > Answer a client’s security questionnaire from dated facts on your Macs. Name what is missing, give open questions an owner and use the blank worksheet. Page: https://cybee.ai/blog/mac-security-questionnaire/ (Mac security questionnaire: evidence template) - [Blog](https://cybee.ai/blog/) - Security questionnaire client requests The questionnaire arrives when the contract is nearly ready, and the deal waits for your answers. Start with the questions about your Macs. Those you can back with facts. Then give every other question an owner. In a small team that owner is often you, and “not yet”, with a date and a next step, is an honest answer. By [cybee](https://cybee.ai/about/#founders) Updated 24.09.2026 6 minute read, plus the worksheet Jump to the worksheet In one minute - A client, partner or insurer sends a security questionnaire before they sign with you. The deal often waits for your answers. - Answer each question only as far as your evidence goes: which Macs, which dates, what nobody checked. - Your Macs can answer the device questions from dated facts. Questions about backups, access or policies go to the person who owns them. - Name every missing Mac and every open item, and write down who follows up. - Before you send, read the wording against the evidence. The worksheet below walks you through it. ## How do you answer a client security questionnaire? Match each question to the devices, systems and time period it covers. Answer the technical questions from dated findings. Say which evidence is missing, and pass questions about business policy to the people who own them. Read the final wording before you share it. A report on your devices supports your device answers. It does not certify the whole company. **Q:** What is a security questionnaire? ### What a security questionnaire is. A list of questions a client, partner or insurer sends before they work with you. It asks how you protect their data: on the computers your team uses, in your accounts and in the way your company works. It usually arrives late, when the contract is nearly ready. Some arrive as a spreadsheet, some as an online form. Either way, the deal tends to wait until your answers come back. [See a worked example](https://cybee.ai/use-cases/security-questionnaires/) Why clients ask their suppliers 30% of the data leaks Verizon studied involved a third party, such as a supplier. So your clients now ask their suppliers, and that includes you. Source: Verizon DBIR 2025 4% of companies count as fully prepared in Cisco’s yearly study. Most are still getting ready. An honest answer with dates is a good place to start. Source: Cisco Cybersecurity Readiness Index 2025 ## Do more than tick “yes”. The question says: “Are all laptops encrypted?” A short answer can sound right and still claim more than your evidence shows. So first, find out which laptops the client means, and over which period. Figure: A fictional team of eight. The same question, answered two ways. > The missing Mac stays part of the answer. **Q:** What does encrypted mean here? ### What disk encryption means. Disk encryption scrambles everything stored on a Mac, so a lost or stolen laptop cannot be read without the password. On a Mac it is called FileVault. Clients ask about it because laptops get lost. The honest answer names each Mac, whether encryption was on and when that was seen. ## Match each question to its evidence. A security questionnaire mixes different subjects. Sort the questions before you fill anything in. One person can collect all the answers without being the one who supplies each of them. devices ### Your Macs. “Are all laptops encrypted?” Encryption, protection, updates and settings. Check the device facts, with their dates. answered by the record of each Mac the business ### Your company. “How do you back up client data?” Access, backups, policies and suppliers. The person responsible supplies the process and its evidence. answered by the person who owns it independent review ### An outside report. “Please attach your audit report.” A certification or audit the client requires. Check the actual document and what it covers. answered by that document only Accounts have their own record Connected Google Workspace accounts have their own account record. It is kept apart from the record of your Macs, and it does not answer for every other cloud account. **Q:** What counts as evidence? ### What counts as evidence. A dated fact about one setting on one Mac. It can come from software on the Mac, or from your own check with the date written down. The client decides which it accepts. For example: disk encryption on, Ana’s MacBook Pro, 26.09.2026. A written policy says what should happen. Evidence shows what was actually true, and when. **Q:** What is an independent review? ### What an independent review is. An outside firm checks your company against a standard and signs a report. SOC 2 and ISO 27001 are the names clients mention most often. If a client requires one, only that report answers the question. A record of your Macs can support your answers. It does not replace the report. [Does your agency need SOC 2?](https://cybee.ai/blog/soc-2-small-agency/) ## Give an open question an owner. A missing Mac may be offline, not connected or not supported. None of those tells you it is secure. Write down who will follow up, and what you can say until then. If a setting is fixed today, check it again. The new check does not show that the setting was right last month. Keep the earlier record and the later one apart. Figure: Two records, kept apart. The fix at 09:42 does not change what was true on Thursday. ## Check four things before sending. before you send four checks - Does the answer cover the Macs and the period the client asked about? - Are missing Macs and open findings named? - Does the wording match the attached evidence? - Have you kept the answer, its evidence and the date you sent it? If an AI assistant drafted any of the answers, check those too. A questionnaire does not give anyone permission to change a device or to share unrelated data. And the client decides whether your answer meets their requirement, not you. ## What cybee contributes. cybee runs on the Macs your team works on and keeps a dated record of what it observes. Ask your AI assistant a device question, such as which Macs have disk encryption on, and cybee answers from that record. When a client wants something they can check, you send the Trust Passport. It records technical observations on the listed Macs, with dates. Its seal can be compared with cybee’s copy, to check that the sealed content has not changed. That is not an independent audit or a certification. Use it to prepare your device answers when a client, partner or insurer asks. Broader requests, such as a public tender, can need more documents. Figure: What the client receives: one page, dated, with its gap and its limits listed. **Q:** What exactly is a Trust Passport? ### The Trust Passport. The Trust Passport is a dated record of how your Macs are protected. Your client or insurer opens it through one link and sees what holds, since when, and what cybee could not see. It is not a certification or an audit, and it does not answer for your policies, your people or your cloud. It says so on the page. Sealed means the record carries a fingerprint, a short code made from its content. Your client can compare it with the copy cybee sealed and see whether anything was changed afterwards. That shows the record was not edited. It does not check the facts a second time. Proof plan The sealed Trust Passport is part of the Proof plan: CHF 9 per Mac per month, or 90 a year, excluding tax, with a 14 day trial. Protection and the 118 checks stay free on every Mac. [Read a Trust Passport properly](https://cybee.ai/docs/trust-passport/)[See the plans](https://cybee.ai/pricing/) ## Build your Mac evidence worksheet. Use these eight prompts to prepare your answer to a client. Copy the client’s exact question into the scope column, then add dated evidence, what is missing and an owner. Fill in Macs expected and Macs checked only where the question is about devices. The file starts empty: no device findings, no finished answers. Blank CSV no sign up use it with your own records Record your findings in the downloaded file and leave unknowns open. You fill this template in by hand. It is not a cybee export, an automated assessment or a certification. If the button does nothing, copy the eight prompts below into your own sheet. They are the whole worksheet. ### Which Macs does the client’s question cover? Collect List the project, the review period and the Macs you expect, including contractors’ devices. Compare that list with the Macs that were actually assessed. Keep the limit visible The Macs with cybee on them may not be every computer used for the work. Keep missing devices visible. ### What evidence supports the disk encryption answer? Collect For each Mac the question covers, write down whether disk encryption (FileVault) was on, the date you saw it and which Mac it was. Do not paste any codes or keys. Note where the full record is kept. Keep the limit visible One Mac’s setting says nothing about the rest of the team, your backups or data on its way somewhere else. ### Do the observed screen lock settings meet the client’s requirement? Collect Write down the lock time the client requires and the settings you observed. Note any device that still needs a change or a fresh check. Keep the limit visible A written policy does not show the current setting. Do not make up one lock time that fits everyone. ### Which macOS or app updates still need attention? Collect Record the versions or update findings for the assessed Macs, when they were checked, and who owns each item that is still open. Keep the limit visible A list of versions is a dated observation. It does not prove that every weakness has been fixed. ### What protection status was actually checked? Collect Name the protection, the Macs it covers, the status you observed and when you observed it. An app that is installed is not the same as a status that was checked. Keep the limit visible Installing something does not prove that it works, or that every attack will be stopped. ### Does the question also cover accounts and access? Collect Send questions about accounts, connected apps and people who leave to whoever runs each service. Point to the account review or the connected Workspace record separately. Keep the limit visible The record of a Mac does not answer every account question. Device evidence and account evidence cover different things. ### Which answers need company records beyond the Macs? Collect Give questions about backups, training, incident response, how long you keep data, or outside reviews to the right owner. Name the actual record each answer needs. Keep the limit visible Device findings do not show compliance across the whole company. They are not an independent audit or a certification. ### Can a responsible person stand behind every answer you send? Collect Check the client’s wording against the evidence date, the scope, the assessed count and the expected count. Keep unknowns, exceptions and next steps in the review. Keep the limit visible Filling in this worksheet organises your review. It does not turn an unknown into a “yes”, and it does not send anything to the client. Technical background: [Apple: FileVault and device management](https://support.apple.com/guide/deployment/manage-filevault-with-device-management-dep0a2cb7686/web) Template by cybee · revised 24.09.2026. The article above explains the method. ## Sources and product scope. Written by cybee for small teams. The provider references explain the underlying controls and what an independent report is. Our documentation sets out what cybee covers today. - [cybee: Trust Passport](https://cybee.ai/docs/trust-passport/) - [AICPA: independent SOC reporting](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) - [Apple: FileVault and device management](https://support.apple.com/guide/deployment/manage-filevault-with-device-management-dep0a2cb7686/web) ## Use this on your next questionnaire. See a sample answer, the device facts behind it and the questions your team still owns. [Work through an example](https://cybee.ai/use-cases/security-questionnaires/) On this page - The short answer - Do more than tick “yes” - Match questions to evidence - Give open questions an owner - Four checks before sending - What cybee contributes - The worksheet - Sources cybee Answers the device questions from dated facts on your Macs. The answers are free on every Mac. The sealed record you send the client is part of the Proof plan. [See how it works](https://cybee.ai/product/) ## The next question someone asks. Three more guides. [client requests What evidence should you prepare for cyber insurance? What an insurer asks about your Macs, and what to have ready before the renewal. Read the guide](https://cybee.ai/blog/cyber-insurance-evidence/) [client requests Does your agency need SOC 2 to win bigger clients? How to read a client’s request for an audit report, and when one fits your business. Read the guide](https://cybee.ai/blog/soc-2-small-agency/) [Mac security Are Macs secure enough for a small business? What your Mac already protects, and what a small team still needs to check. Read the guide](https://cybee.ai/blog/mac-security-small-business/) ## Your next client will ask. Be ready. `curl -sSf https://get.cybee.dev | sh` Run it in Terminal, a chat, your IDE or a CLI. Keep working where you started. Free for every Mac with an Apple chip · Asks before it changes your Mac [What it installs](https://cybee.ai/docs/install/#see) [Read the install script](https://get.cybee.dev)