DEV Community: security answer kit

Five security fixes a small team can make in about an hour each

security answer kit — Tue, 20 Oct 2026 12:48:19 +0000

Security questionnaires keep asking about the same handful of controls. These five come up again and again, and each one is a settings change for a small team. They are also the ones where "no" is the hardest answer to give a client.

1. Multi-factor authentication

Turn on MFA for every account in email, code hosting, cloud consoles and admin panels. Use an authenticator app or a security key, not SMS, where possible.

2. Full-disk encryption and screen lock

Switch on FileVault on macOS or BitLocker on Windows, and set a screen lock of 5 minutes or less, on every work laptop. If a laptop is lost, the data is not readable, and that is the answer the client wants to hear.

3. Automatic updates

Switch on automatic updates for the operating system and browsers on every work device. This also answers the question about how quickly critical patches are applied.

4. A password manager

Roll out a password manager for everyone and move shared logins into shared vaults. Passwords stop travelling through chat and documents.

5. Dependency alerts

Switch on dependency alerts in your code hosting (for example Dependabot or Renovate) and set a monthly patch day for servers. This is your answer to "how do you manage vulnerabilities in your software?".

Why do these first

Each fix turns a "no" or "partly" in your questionnaire into a "yes", and each one is verifiable: a client can ask for a screenshot of the setting. Fix first, then answer. Your answers become shorter and more convincing.

Find your own gaps

The free Security Overview builder asks about 26 controls, including these, and gives a fix step for every gap. If you work through a questionnaire area by area, our guides start at the hub, for example the one on device security questions.

Disclosure: this account is published by Security Answer Kit, the maker of the tool linked above (EUR 49 for the full kit, the Security Overview builder is free). This article was written with AI assistance and checked against the kit's own content before it was queued, as dev.to's guidelines for AI-assisted articles ask (https://dev.to/guidelines-for-ai-assisted-articles-on-dev).

What to answer when the questionnaire asks 'is MFA enforced for all users?'

security answer kit — Sat, 17 Oct 2026 11:41:07 +0000

MFA questions appear in almost every vendor questionnaire, in many wordings. The same few controls sit behind all of them. If you know the controls, you can answer every variant the same way.

The variants

Is multi-factor authentication enforced for all users?
Is MFA required for remote and administrative access?
Is MFA enforced on your email system?
Is MFA enforced on your source code repositories?

What the client wants to know

They want to know that a stolen password is not enough to reach their data. They do not expect a small vendor to run a hardware token programme. They expect you to name the systems and be accurate.

An answer when MFA is everywhere

Name the systems: email, code hosting, cloud consoles and admin panels. Say that authenticator apps or security keys are used where the service supports them. One sentence is enough.

An answer when MFA is not everywhere yet

Do not answer yes. Say which systems have it, say enabling it on all accounts is the first priority, and give a date. A statement like "not on every system yet, this is our first priority, planned by 31 December 2026" is one a client can accept and later check.

The fix itself

Turn on MFA for every account in email, code hosting, cloud consoles and admin panels. Use an authenticator app or a security key rather than SMS where possible. For a small team this is usually an hour of settings.

How a small team can answer a vendor security questionnaire in an afternoon

security answer kit — Wed, 14 Oct 2026 12:56:39 +0000

A bigger client sends you a spreadsheet with 100 or more security questions before they sign. You have no security team. What do you do?

This is the process we recommend for agencies, freelancers and software firms with 1 to 25 people. It has 6 steps and none of them needs a certification.

1. Ask which sections apply

Questionnaires are written for every kind of vendor. Ask the client which sections apply to a vendor of your size. Ask for more time if you need it. Both are normal requests.

2. Send a one-page overview first

A short Security Overview that lists the controls you have in place often answers many questions before the client opens the spreadsheet. It should say who is responsible for security, where data is hosted, and which controls exist: MFA, disk encryption, backups, an incident plan.

3. Write down what is true today

Go through the controls one by one and mark each as in place, partly in place or missing. Be strict. "Partly" means some systems or some people, not all. Your answers must match what you actually do, because the client may ask you to prove them.

4. Answer gaps honestly, with a date

For a control you do not have, say so, say what you do instead, and give a target date. For example, if MFA is not on every account yet, the honest answer says it is not on every system yet, names enabling it everywhere as the first priority and gives a date. A client can work with a dated gap. A claim that turns out to be false ends the deal.

5. Fix the cheap gaps

Most fixes for a small team are settings you can change in an hour: MFA, full-disk encryption and automatic updates. Do these before you send the answers, and your answers get better without any extra writing.

6. Reuse the answers

Questions are worded differently in every questionnaire, but they ask about the same controls. Keep one answer per control and copy it into the next questionnaire. If the client uses their own spreadsheet, paste the answers in.

A free tool for steps 2 and 3

The Security Answer Kit has a free builder that asks about the controls, writes the one-page overview and lists the gaps with a fix step for each. It runs in your browser and uploads nothing: build your overview. The guide on how to answer a security questionnaire has the same process with more detail.