Security questionnaire answers › Governance
Do you have a documented information security policy? How to answer it in a security questionnaire
Why buyers ask this
Written policies show that security is managed deliberately and that staff know the rules.
What a strong answer includes
- State that policies exist, are approved by management, and are reviewed at least annually.
- List the key policies (access control, incident response, vendor management, acceptable use).
- Say how employees acknowledge them.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Yes. We maintain an information security policy and supporting policies covering [access control, incident response, vendor management, acceptable use, data retention]. They are approved by [role], reviewed at least [annually], and acknowledged by all employees at hire and annually.
Evidence to attach
- Policy set with version history
- Acknowledgement records
Common mistakes
- Policies that have never been reviewed or signed off.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.