Security questionnaires: how sellers answer

Anyone who sells to energy companies, transport firms, banks, healthcare providers or municipalities will have noticed the change over the past year. Sweden's cybersecurity act came into force on 15 January 2026, replacing the 2018 act on information security for essential and digital services, and it implements the EU's NIS2 directive. Under the act's second chapter, operators' security measures must take an all-hazards approach and at minimum cover risk analysis, incident handling, continuity management and, as the fourth item, security in the supply chain. The Swedish Agency for Civil Defence, which coordinates the act, says operators are found in 18 sectors and that size is judged by headcount or turnover, with small and micro enterprises exempt as a rule. Under the agency's published timeline, the regulations on security measures and management training were due to take effect on 1 October 2026 as well. In short: your customer has to be able to show that it has vetted you. This is an editorial walkthrough, not legal advice.

What the law demands of your customer, and therefore of you

The requirements are aimed at the customer, not at you as the vendor, but the effect lands on your desk. An operator that has to demonstrate supply chain security needs documentation from its vendors, and the simplest form of documentation is a questionnaire you fill in. Banks and insurers also have the EU's Digital Operational Resilience Act, DORA, which the Swedish Financial Supervisory Authority has applied since 17 January 2025, with specific rules on the risks posed by third-party ICT providers. RAIN Group found in 2026 that 48.4 percent of sales organisations had seen their sales cycles get longer. The security review is one reason why, and it cannot be negotiated away. It can only be prepared for. A good opening move is to ask the customer which sector authority supervises them; the Swedish Agency for Civil Defence names, among others, the Energy Agency for energy, the Transport Agency for transport, the Financial Supervisory Authority for finance, IVO for healthcare providers and PTS for digital infrastructure. The answer tells you which requirements will flow down to you, and shows the customer you have done your reading.

The questionnaires you will run into

• The customer's own questionnaire, built on ISO/IEC 27001, the international standard for information security management systems. The questions track the standard's domains: governance, access control, encryption, operations, suppliers, incidents.
• CAIQ from the Cloud Security Alliance, a standardised questionnaire for cloud services; a CAIQ self-assessment also counts as level one of the CSA's STAR registry, where vendors can file their assessment ahead of time.
• SIG from Shared Assessments, a sprawling third-party risk question library favoured by large companies and financial institutions.
• The short version: ten to twenty questions from an IT manager who wants to know where the data lives, who can get at it, how it is encrypted, what happens in an incident and which subcontractors you use.

Prepare a security one-pager before anyone asks

Most of any questionnaire can be answered in advance, once, in a one-page document a rep can send the same day. What goes in: where the data is stored and in which country, encryption in transit and at rest, how access is controlled and logged, the incident routine with its time limits, the list of subcontractors, which certifications or audit reports exist, how backups and recovery work, when the last penetration test was run, and that a data processing agreement is ready to sign. Write down what you do not have, too. A missing ISO certificate disclosed openly, with a plan, is an answer; a questionnaire with the box left blank is a red flag.

How to answer on the spot without overpromising

When the question lands in the meeting, three rules apply. First: never guess. A wrong yes on encryption gets found in the review, and with it goes the credibility of the entire deal. Second: take the question away, with a date attached. 'I want to answer that precisely, so I'll take it to our head of IT and come back to you on Thursday' beats an approximate yes every time. Third: separate what exists today from what is planned, and say which is which. Bring your IT lead to the second meeting instead of relaying questions back and forth, and treat the security review as a stage of the deal in its own right, with an owner on the customer side and a date by which it should be done.

Five mistakes that drag out the sales cycle

• The questionnaire surfaces in November and gets answered in January, because nobody asked in September whether the customer runs a vendor review.
• The rep fills in the questionnaire alone, without IT, and the answers have to be redone once the customer's security officer starts asking follow-up questions.
• The answers differ from the ones the last customer got, because there is no security one-pager everyone starts from.
• A yes where it should have said 'not yet', which the customer catches in the review and which then colours everything else you said.
• The answer to where the data is stored is 'in the cloud'. The customer wants country, provider and sub-processors; without those the review stalls until someone goes and finds out.

Practise the questions you cannot answer

Security questions rarely arrive in a calm email. They come from an IT manager halfway through your presentation, in a tone that tests whether you know what you are talking about. The answer that works, honest, concrete and with a date, lives in the voice, and that takes practice. In Salesprep you can present to an AI audience that interrupts with exactly that kind of question, and get scored on question handling and recovery after interruption among other things; the Presentation module is available on Team Pro. The Cold call module, with three free calls, is included in every plan.