How to answer an ISO 27001 questionnaire
Published · Qlara
An ISO 27001 questionnaire asks a supplier about its information security management system and relevant security controls. Some buyers ask for certification details; others use ISO 27001 topics to structure their questions even when certification is not required. Answering the questionnaire does not certify the supplier.
Separate certification from control evidence
If the buyer asks whether your organisation is certified, use the organisation's actual certificate and its scope. A hosting provider's certificate is evidence about that provider, not proof that your company holds the same certification.
State the applicable standard and version as documented. If a requested certification is absent, do not turn a related policy or a different certificate into an affirmative answer. A supplier can describe implemented controls without claiming certification.
Prepare the right source material
Useful sources may include the information security policy, risk assessment process, access control policy, incident response plan, continuity procedures, and a Statement of Applicability. The relevant set depends on the buyer's questions and the supplier's scope.
Keep document ownership, approval, effective dates, and review frequencies current. When the buyer asks for the owner and executive approver, both are required; the policy's title alone does not supply them.
Review before returning the workbook
A control-topic match is only the beginning. Check whether the answer provides each requested detail and whether the evidence actually covers the contracted service.
- Confirm the organisation and service scope named in the buyer's request.
- Collect the current policy, certificate, and requested supporting attachments.
- Draft answers with exact standard identifiers, dates, and frequencies.
- Review missing evidence and unsupported certification statements.
- Use the buyer's evidence references and leave buyer-owned assessment fields unchanged.
Where Qlara helps
Qlara can draft questionnaire responses from approved source material and flag rows that need evidence or review. Citations remain available to the reviewer, while buyer-facing answer cells contain the response itself. Qlara does not supply an ISO 27001 certificate, perform a certification audit, or guarantee compliance.
For a certification question, make the certificate available as evidence rather than relying on an old questionnaire answer. For a control question, verify implementation and scope with the responsible control owner.