Why so many questionnaires look like ISO 27001
ISO 27001 is the most widely used information security standard, and its Annex A is a list of controls grouped into themes. When a customer's security team writes a questionnaire, Annex A is the checklist they start from, even if the questionnaire never mentions ISO. So the questions arrive in a recognisable order: policies and organisation, people, physical, technology.
The themes, and what each one asks
Organisational controls. Do you have an information security policy, who owns security, how are roles defined, how do you manage suppliers, how do you classify information, how do you handle incidents, how do you plan for continuity, what are your legal and contractual obligations. This is the largest group and the one where written policies matter most.
People controls. Screening before hiring, terms of employment, security awareness training, disciplinary process, what happens when someone leaves, confidentiality agreements, remote working rules.
Physical controls. Secure areas, entry controls, protection against environmental threats, equipment security, clear desk and clear screen, secure disposal. For a cloud company, most of this is answered by the hosting provider's certification, plus what you do about laptops and offices.
Technological controls. Endpoint devices, privileged access, access restriction, authentication, capacity management, malware protection, vulnerability management, logging and monitoring, backup, redundancy, network security, cryptography, secure development, change management, test data, code review.
Answering with a certificate
If you are certified, the certificate, its scope and the statement of applicability answer a large part of any ISO-shaped questionnaire. Attach the certificate, quote the scope exactly (reviewers check that the service they are buying is inside it), and for each theme answer from the statement of applicability: which controls apply, how they are implemented, and who owns them. Expect questions about the last surveillance audit and any nonconformities.
Answering without one
You can still answer every row. For each control, say whether you have it, how it is implemented, who owns it and where the evidence is; and for the ones you do not have, say so and what you do instead or when it is planned. A vendor with clear, honest answers and a plan often passes a customer's review; a vendor with a certificate and vague answers sometimes does not.
Keep the mapping, not the questionnaires
The same Annex A control will be asked about in every questionnaire from now on, in different words. Keep one approved answer per control, with its evidence and its date, and draft each questionnaire from that. In Responsemate that answer lives once in the knowledge base, with its file and its expiry date, and every questionnaire is drafted from it with the source shown on each row. Knowledge in Responsemate.
Questions people ask
Do we need ISO 27001 certification to answer an ISO 27001 questionnaire?
No. The questionnaire asks whether you have the controls, not whether an auditor has checked them. A certificate lets you answer many rows with "certified, see the certificate and the statement of applicability"; without one you answer each row on its merits.
What is the statement of applicability?
The document in an ISO 27001 system that lists every Annex A control and says whether it applies to you and how it is implemented. Reviewers who know ISO ask for it because it answers most of their questionnaire in one document.