Answer each question with a specific, true statement about what you do today, say what is planned and when, and attach evidence if you have it. Never claim a certification or practice you do not have. A funder trusts an honest "not yet, planned for March" more than a vague yes.
What funders are really checking
Most questionnaires try to learn whether you will handle their data, and their reputation, responsibly. Reviewers know small organizations cannot match a large company. They look for clarity, ownership and honesty.
A five step method
- Read the whole form first. Group questions by theme: access, data, devices, incidents, vendors.
- Find the owner for each theme. One person should be able to stand behind each answer.
- Check the facts. Do not answer from memory. Open the settings and confirm MFA is actually on.
- Write short answers. One or two sentences, with specifics.
- Keep a copy. Reuse your answers next time, with a review date.
Wording that works
| Weak answer | Stronger answer |
|---|---|
| "We take security very seriously." | "MFA is required on email and admin accounts, checked in September." |
| "Yes, we are compliant." | "We follow a written access policy. We do not hold a formal certification." |
| "Data is encrypted." | "Our donor system encrypts data in transit and at rest, per the vendor's documentation." |
| "We have a plan." | "A one page incident plan names three contacts. We last read it in June." |
Only claim what you can prove. If a question asks for a standard you have not met, say so and describe what you do instead.
Handling questions you cannot answer
Do not leave blanks and do not bluff. Use one of these forms:
- "We do not currently do this. We plan to by (date)."
- "This is handled by our vendor, and we can share their documentation."
- "This does not apply because (reason)."
Be careful with certifications. If a vendor says they hold a report or certificate, ask them for it and quote it exactly. Your own organization should not describe itself as certified or compliant with a framework unless an assessment confirms it.
Offer evidence
Keep a folder with items you can share on request: a screenshot of the MFA setting, your access list with dates, your backup test note, your volunteer briefing page. See our post on what a one page record can show.
Keep the effort proportional
A questionnaire can eat days. Build a standard answer sheet once and update it twice a year. Many funders ask the same twenty questions, so the second form takes an hour, not a week.
Use the questions to improve
Each gap you note is a free list of next steps. If three funders ask about incident plans, write one. If two ask about backups, test a restore.
Quick check
Can we say we follow a framework like the CIS Controls?
Say which parts you follow, for example "we have adopted the essential hygiene safeguards listed as IG1 for these items." Do not imply a formal assessment unless you have one.
What if we need legal advice on the contract terms?
Ask your own counsel. This guide covers answering security questions, not contract law.
Last reviewed: 19 October 2026.
