On this page
How do you answer a client security questionnaire?
Match each question to the devices, systems and time period it covers. Answer the technical questions from dated findings. Say which evidence is missing, and pass questions about business policy to the people who own them. Read the final wording before you share it.
A report on your devices supports your device answers. It does not certify the whole company.
What is a security questionnaire?
What a security questionnaire is.
A list of questions a client, partner or insurer sends before they work with you. It asks how you protect their data: on the computers your team uses, in your accounts and in the way your company works.
It usually arrives late, when the contract is nearly ready. Some arrive as a spreadsheet, some as an online form. Either way, the deal tends to wait until your answers come back.
Why clients ask their suppliers
30%
of the data leaks Verizon studied involved a third party, such as a supplier. So your clients now ask their suppliers, and that includes you.
Source: Verizon DBIR 2025
4%
of companies count as fully prepared in Cisco’s yearly study. Most are still getting ready. An honest answer with dates is a good place to start.
Source: Cisco Cybersecurity Readiness Index 2025
Do more than tick “yes”.
The question says: “Are all laptops encrypted?” A short answer can sound right and still claim more than your evidence shows. So first, find out which laptops the client means, and over which period.
from a client questionnaire
Are all eight project laptops encrypted?
Too broad
“Yes, our laptops are encrypted.”
- It does not say which laptops were checked.
- It has no date.
- The client has to take your word for it.
It sounds right. It claims more than anyone checked.
Supported by the record
“Encryption was observed on seven assessed Macs. The eighth Mac was not assessed. The attached record gives the dates for each device.”
- It names what was checked.
- Every Mac has a date.
- The Mac nobody assessed is still in the answer.
The client can check every word.
The missing Mac stays part of the answer.
What does encrypted mean here?
What disk encryption means.
Disk encryption scrambles everything stored on a Mac, so a lost or stolen laptop cannot be read without the password. On a Mac it is called FileVault.
Clients ask about it because laptops get lost. The honest answer names each Mac, whether encryption was on and when that was seen.
Match each question to its evidence.
A security questionnaire mixes different subjects. Sort the questions before you fill anything in. One person can collect all the answers without being the one who supplies each of them.
-
devices
Your Macs.
“Are all laptops encrypted?”
Encryption, protection, updates and settings. Check the device facts, with their dates.
answered by the record of each Mac
-
the business
Your company.
“How do you back up client data?”
Access, backups, policies and suppliers. The person responsible supplies the process and its evidence.
answered by the person who owns it
-
independent review
An outside report.
“Please attach your audit report.”
A certification or audit the client requires. Check the actual document and what it covers.
answered by that document only
What counts as evidence?
What counts as evidence.
A dated fact about one setting on one Mac. It can come from software on the Mac, or from your own check with the date written down. The client decides which it accepts. For example: disk encryption on, Ana’s MacBook Pro, 26.09.2026.
A written policy says what should happen. Evidence shows what was actually true, and when.
What is an independent review?
What an independent review is.
An outside firm checks your company against a standard and signs a report. SOC 2 and ISO 27001 are the names clients mention most often.
If a client requires one, only that report answers the question. A record of your Macs can support your answers. It does not replace the report.
Give an open question an owner.
A missing Mac may be offline, not connected or not supported. None of those tells you it is secure. Write down who will follow up, and what you can say until then.
If a setting is fixed today, check it again. The new check does not show that the setting was right last month. Keep the earlier record and the later one apart.
Mira’s MacBook Air26.09.2026
dated recordr-0926-0941
09:41
117 of 118 checks hold.
- Disk encryptionOn since 12.03.2026
- Screen lockOff since Thu 14:02
Open item. Owner: Mira.
Mira says yes
dated recordr-0926-0942
09:42
118 of 118 checks hold.
- Disk encryptionOn since 12.03.2026
- Screen lockOn since 09:42
No open items.
Check four things before sending.
before you sendfour checks
- Does the answer cover the Macs and the period the client asked about?
- Are missing Macs and open findings named?
- Does the wording match the attached evidence?
- Have you kept the answer, its evidence and the date you sent it?
If an AI assistant drafted any of the answers, check those too. A questionnaire does not give anyone permission to change a device or to share unrelated data. And the client decides whether your answer meets their requirement, not you.
What cybee contributes.
cybee runs on the Macs your team works on and keeps a dated record of what it observes. Ask your AI assistant a device question, such as which Macs have disk encryption on, and cybee answers from that record.
When a client wants something they can check, you send the Trust Passport. It records technical observations on the listed Macs, with dates. Its seal can be compared with cybee’s copy, to check that the sealed content has not changed. That is not an independent audit or a certification.
Use it to prepare your device answers when a client, partner or insurer asks. Broader requests, such as a public tender, can need more documents.
26.09.2026 09:45 · prepared for a client questionnaire
Four Macs. Every check holds. One day not observed.
- Macs protected
- 4 of 4
- Checks holding
- 118 of 118
- Days observed
- 89 of 90
| Control | Since |
|---|---|
| Disk encryption | since 12.03.2026 |
| Behavioural protection | since 12.03.2026 |
| Screen lock | since 26.09.2026 09:42 |
- Not observed: one Mac on 21.09.2026, offline.
- Not covered: your policies, your people, your cloud. Not a certification.
What exactly is a Trust Passport?
The Trust Passport.
The Trust Passport is a dated record of how your Macs are protected. Your client or insurer opens it through one link and sees what holds, since when, and what cybee could not see. It is not a certification or an audit, and it does not answer for your policies, your people or your cloud. It says so on the page.
Sealed means the record carries a fingerprint, a short code made from its content. Your client can compare it with the copy cybee sealed and see whether anything was changed afterwards. That shows the record was not edited. It does not check the facts a second time.
Build your Mac evidence worksheet.
Use these eight prompts to prepare your answer to a client. Copy the client’s exact question into the scope column, then add dated evidence, what is missing and an owner. Fill in Macs expected and Macs checked only where the question is about devices. The file starts empty: no device findings, no finished answers.
Blank CSVno sign upuse it with your own records
Record your findings in the downloaded file and leave unknowns open. You fill this template in by hand. It is not a cybee export, an automated assessment or a certification.
If the button does nothing, copy the eight prompts below into your own sheet. They are the whole worksheet.
Tick a prompt once you know the evidence it needs. Ticks stay in this tab and clear when you reload.
-
Which Macs does the client’s question cover?
- Collect
- List the project, the review period and the Macs you expect, including contractors’ devices. Compare that list with the Macs that were actually assessed.
- Keep the limit visible
- The Macs with cybee on them may not be every computer used for the work. Keep missing devices visible.
-
What evidence supports the disk encryption answer?
- Collect
- For each Mac the question covers, write down whether disk encryption (FileVault) was on, the date you saw it and which Mac it was. Do not paste any codes or keys. Note where the full record is kept.
- Keep the limit visible
- One Mac’s setting says nothing about the rest of the team, your backups or data on its way somewhere else.
-
Do the observed screen lock settings meet the client’s requirement?
- Collect
- Write down the lock time the client requires and the settings you observed. Note any device that still needs a change or a fresh check.
- Keep the limit visible
- A written policy does not show the current setting. Do not make up one lock time that fits everyone.
-
Which macOS or app updates still need attention?
- Collect
- Record the versions or update findings for the assessed Macs, when they were checked, and who owns each item that is still open.
- Keep the limit visible
- A list of versions is a dated observation. It does not prove that every weakness has been fixed.
-
What protection status was actually checked?
- Collect
- Name the protection, the Macs it covers, the status you observed and when you observed it. An app that is installed is not the same as a status that was checked.
- Keep the limit visible
- Installing something does not prove that it works, or that every attack will be stopped.
-
Does the question also cover accounts and access?
- Collect
- Send questions about accounts, connected apps and people who leave to whoever runs each service. Point to the account review or the connected Workspace record separately.
- Keep the limit visible
- The record of a Mac does not answer every account question. Device evidence and account evidence cover different things.
-
Which answers need company records beyond the Macs?
- Collect
- Give questions about backups, training, incident response, how long you keep data, or outside reviews to the right owner. Name the actual record each answer needs.
- Keep the limit visible
- Device findings do not show compliance across the whole company. They are not an independent audit or a certification.
-
Can a responsible person stand behind every answer you send?
- Collect
- Check the client’s wording against the evidence date, the scope, the assessed count and the expected count. Keep unknowns, exceptions and next steps in the review.
- Keep the limit visible
- Filling in this worksheet organises your review. It does not turn an unknown into a “yes”, and it does not send anything to the client.
All eight prompts are marked as reviewed. Check your records and any open gaps before you share an answer.
Technical background: Apple: FileVault and device management
Template by cybee · revised 24.09.2026. The article above explains the method.
Sources and product scope.
Written by cybee for small teams. The provider references explain the underlying controls and what an independent report is. Our documentation sets out what cybee covers today.
Use this on your next questionnaire.
See a sample answer, the device facts behind it and the questions your team still owns.
