Security questionnaires keep asking about the same handful of controls. These five come up again and again, and each one is a settings change for a small team. They are also the ones where "no" is the hardest answer to give a client.
1. Multi-factor authentication
Turn on MFA for every account in email, code hosting, cloud consoles and admin panels. Use an authenticator app or a security key, not SMS, where possible.
2. Full-disk encryption and screen lock
Switch on FileVault on macOS or BitLocker on Windows, and set a screen lock of 5 minutes or less, on every work laptop. If a laptop is lost, the data is not readable, and that is the answer the client wants to hear.
3. Automatic updates
Switch on automatic updates for the operating system and browsers on every work device. This also answers the question about how quickly critical patches are applied.
4. A password manager
Roll out a password manager for everyone and move shared logins into shared vaults. Passwords stop travelling through chat and documents.
5. Dependency alerts
Switch on dependency alerts in your code hosting (for example Dependabot or Renovate) and set a monthly patch day for servers. This is your answer to "how do you manage vulnerabilities in your software?".
Why do these first
Each fix turns a "no" or "partly" in your questionnaire into a "yes", and each one is verifiable: a client can ask for a screenshot of the setting. Fix first, then answer. Your answers become shorter and more convincing.
Find your own gaps
The free Security Overview builder asks about 26 controls, including these, and gives a fix step for every gap. If you work through a questionnaire area by area, our guides start at the hub, for example the one on device security questions.
Disclosure: this account is published by Security Answer Kit, the maker of the tool linked above (EUR 49 for the full kit, the Security Overview builder is free). This article was written with AI assistance and checked against the kit's own content before it was queued, as dev.to's guidelines for AI-assisted articles ask (https://dev.to/guidelines-for-ai-assisted-articles-on-dev).
Top comments (0)