What should you do when a client sends a cyber-security questionnaire?
The questionnaire usually arrives at the worst moment: a pitch is moving, procurement has a deadline, and someone senior asks the studio manager to “just get it done”. The document is thirty pages. Half of the questions assume a security team you do not have.
Do not invent the company
Answer the questions that you can answer from something you could show. If you have multi-factor authentication on email, say so, and say where. If you do not know which AI tools the team uses, do not write that AI is governed. A client who later finds the opposite answer will trust you less than if you had said “not yet”.
Where the true answer is incomplete, write the gap and the date you expect to close it. “We do not have a complete SaaS inventory. We will have one by the end of next month, covering the systems that store your files.” That is a better answer than a blank box or a hopeful yes.
Use it twice
The first use is the tender. The second is your own list. Questionnaires repeat themselves: access, suppliers, backups, incident contacts, where data is stored, whether subcontractors and freelancers are covered. If you keep a short pack of evidence for those questions, the next form is an afternoon rather than a crisis.
That pack is part of cyber governance. It is also the thing a client is really asking for when they send the spreadsheet.
If this is the question already sitting with you, a conversation is the useful next step.