Stuck on the questionnaire? Here's how to answer it — properly

First, the reassuring part: the questionnaire is not a trick. Every question maps to one of the five control areas, and the assessor reading your submission wants to establish one thing — that the controls are actually in place across everything in scope. Answers fail when they are vague, contradictory, or describe an organisation that plainly isn't yours. They pass when they are specific and true.

Why copied answers backfire

There are documents in circulation offering pre-written answers to paste in. Two problems. The practical one: assessors read hundreds of submissions and recognise boilerplate instantly — an answer that doesn't match your stated device list, headcount or services triggers exactly the queries you were trying to avoid. The serious one: the declaration is signed at board level confirming the answers are accurate for your organisation. A certificate obtained on answers that describe someone else's setup is worthless the day you need it — to a customer doing due diligence, and to the insurer behind the cyber cover that comes with certification.

The questions people actually get stuck on

"List your operating systems and versions." Stuck usually means — nobody knows. The answer comes from checking each device, not estimating. If checking turns up something out of vendor support, that machine is a finding whether you declare it or not; declared, it's a remediation item, undeclared, it's a false submission.

The MFA questions. The requirement is MFA on cloud services — and "we have it on email" is not "we have it on our cloud services." Work from your service list: email, accounts package, storage, website admin, banking. Where a service genuinely doesn't offer MFA, say so plainly — that's an answer an assessor can work with, unlike silence.

The BYOD questions. Personal phones checking organisational email are in scope, and the questionnaire asks about them directly. The honest routes are: bring them up to standard, restrict access so they're out of scope, or declare them as they are — pretending they don't exist fails the moment your answer says five staff and three devices. How scope and personal devices really work.

"Describe your scope." Name the entity, the locations, the device types, the cloud services; state exclusions and justify them. "Whole organisation" is a perfectly good answer when it's true — and it usually is for small organisations.

The admin account questions. The requirement is separation: admin rights used for admin tasks, daily work done on standard accounts. If your one IT-ish person does everything as admin, that's the fix to make before submitting — it's configuration, not procurement.

When your setup doesn't fit the question

Small organisations hit questions written with bigger ones in mind. The rule: answer what is true for you and add the sentence of context that makes it make sense. Assessors deal with sole traders, parishes, charities and five-person firms constantly — "we have no servers; all services are cloud-based" is a normal answer, not a failure. What you must not do is guess what a big-company answer would look like and write that instead.

If the assessor comes back with queries

Queries are usually about precision — a version number, a clarification of scope wording, evidence that MFA is on where you said it is. Respond specifically, promptly, and within the window given; a clear answer with a screenshot closes a query in one round. What extends the correspondence is defensiveness or a restated vague answer.

Scheme requirements are set by the NCSC and IASME and are reviewed periodically. Confirm the requirements applying to your own assessment before you begin.