To answer customer security questionnaires with ISO 27001, keep a library of approved answers that point to your information security management system: policies, controls in your statement of applicability, and dated evidence. Be exact about certificate scope and status, and never imply certification you do not hold.
Why does ISO 27001 help here?
A questionnaire asks the same dozens of questions in different words: how you manage access, handle incidents, train staff, patch systems and vet suppliers. A management system already organizes those answers. If your controls are documented and your evidence is current, each new questionnaire is matching work, not research.
ISO 27001 is a standard for a management system. A certificate means an accredited certification body audited that system against the standard for a defined scope. It does not mean your product has no flaws.
How do you build the answer library?
Start from what you can prove. For each recurring topic, write one answer with three parts: the plain statement, the control or policy it comes from, and the evidence item that backs it up.
For example, under vulnerability management you would state how often you scan, name the policy, and link to a dated scan record. Keep the answer short enough to paste and specific enough to check.
Tag each answer with a review date and an owner. Stale answers cause more trouble than missing ones, because customers hold you to what you wrote.
What must be precise?
Scope. A certificate covers a stated scope: certain sites, services and processes. If a customer's product runs outside that scope, say so. Do not let the certificate stand in for coverage it lacks.
Status. Say exactly where you are: certified, in an audit cycle, or aligned but not certified. These are three different statements. Misusing the certificate or implying certification you do not have is itself treated as a serious problem by certification practitioners.
Version. Name the edition of the standard you are audited against.
Exceptions. Your statement of applicability can exclude controls with a reason. If a question touches an excluded control, answer honestly rather than skipping it.
What do customers really want behind the questions?
Mostly three things: that you have thought about the risk, that someone owns it, and that you can show your work. Offer the certificate and scope statement up front, since it shortens many reviews. Then answer the remaining questions from the library, and attach evidence when asked rather than dumping files unasked.
If a question has no good answer, write a plain one. A short honest gap with a dated plan reads better than a vague claim.
Where does supply chain detail come in?
Buyers increasingly want to know how you track the open source you ship. Be ready to explain how you inventory components, how you match them against known vulnerabilities and how fast you act. If your answer relies on tooling that produces an SBOM and a scan history, point to those artifacts. The statement that you have an inventory must match what the files show.
What to do
- Write the certificate status and scope in one approved paragraph, and use it everywhere.
- Build answers for your twenty most asked topics, each with policy and evidence references.
- Assign an owner and a review date to every answer.
- Mark the controls excluded in your statement of applicability and prepare honest responses for them.
- Run a quarterly check where a second person tries to disprove five answers.
- Retire any answer whose evidence you can no longer produce.
Quick check
Can I say we are ISO 27001 compliant if we follow it but are not certified?
Say what is true, for example "aligned with ISO 27001, not certified". Compliant and certified are different claims, and customers read them differently.
Should I attach the whole audit report?
Usually the certificate and a scope statement are enough. Audit reports often contain sensitive detail, so share them only under an agreement your legal team approves.
Sources
- Advisera, Major vs. minor nonconformities in the certification audit, fetched 18 October 2026, for the point that certification covers processes not products.
- NIST SP 800-218, SSDF 1.1, fetched 18 October 2026.
Last reviewed: 18 October 2026.
