Reviewed
Answering a client security questionnaire
A client security questionnaire asks you to describe your organization's security practices. Before drafting answers, gather the relevant policies, settings, and records, and identify who can confirm them.
Support each answer with evidence
For each question, describe the current practice and reference a supporting document or record, such as a policy, an exported setting, or a screenshot. If you cannot verify an answer, record what needs checking and who will check it. Review evidence for confidential information before sharing it, and use the agreed secure channel.
Keep an answer bank
Store reviewed answers with references to their evidence. Before reusing an answer, check that it addresses the new question and still describes your current practices.
Be accurate about what is in progress
Distinguish controls that are in place from those that are planned or partly implemented. For work in progress, state its current status, any interim measures, and the target date if one has been agreed.
PIPEDA generally applies to private-sector organizations that collect, use, or disclose personal information in commercial activities. Other laws or exemptions may apply, including Ontario's rules for personal health information. Confirm which requirements apply to your organization with a qualified professional.
Source: https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/pipeda_brief/. General readiness guidance — not legal advice.