TL;DR
A security questionnaire for devices asks five things in a dozen different wordings. The section is survivable with honest answers and compensating controls. It is not survivable with an answer you rounded up.
- Five themes: issue, encrypt, manage, lose, remove. Plus evidence.
- Never round an answer up. It becomes a representation.
- A clear no with a date beats a vague yes.
- Answer offboarding with your measured time, not your policy’s.
- The sample record is what small teams lack, not the policy.
- Keep a dated answer library. The second one arrives soon.
When this is not your problem yet
Four stages, and the first two can ignore all of it.
Selling to small businesses. Nobody is sending questionnaires. Spend the effort on the product and revisit when a prospect asks.
Best tools for HR Operations
First mid-market prospect. A short form arrives, maybe twenty questions. Answerable in an afternoon if you know your own setup.
First enterprise or regulated buyer. Two hundred questions, a named reviewer and follow-ups. This is where the device section becomes a real obstacle rather than admin.
Several per quarter. Now the cost is repetition, and an answer library with evidence attached pays for itself immediately.
Why a security questionnaire for devices stalls small teams
The questions themselves are not hard. What stops people is that each one has an obvious right answer and a true answer, and those are often different.
Take a standard one: are all endpoints encrypted and centrally managed. A twelve-person company usually encrypts by default because the hardware does it, and manages nothing centrally because there was never a reason to. The honest answer is partial, and partial answers feel like losing the deal, so people write yes and hope the follow-up never comes.
The second difficulty is evidence. A policy can be written in an afternoon. A wipe certificate for a specific laptop cannot, because it is produced by a process that either ran or did not. Reviewers know this, which is why they ask for the artefact rather than the assertion.
The third is that the questions assume a shape. Asset handling in ISO/IEC 27001 and media sanitisation in NIST SP 800-88 are where most of these forms come from, and both assume an organisation that issues, tracks and recovers equipment. A company where half the team uses personal machines is not described by the question being asked.
The five questions underneath the wording
- Do you issue company equipment? They want to know whether company data sits on hardware you control. If the answer is mixed, say which populations differ.
- Is it encrypted and managed? Two separate things. Encryption is often true by default; central management usually is not. Answer both.
- What happens when one is lost? They are testing whether a path exists, not whether it is elaborate. Name the report route and the first action.
- How is data removed at offboarding? Your real process, your real timeframe, and the evidence produced. This is the question that generates follow-ups.
- Can you show it? A policy, a configuration export and one sample record. The third is the one that decides how the rest is read.
Answer those five clearly and most device sections are finished, whatever order the form puts them in.
Five questions to ask yourselves first
Can you list every device holding company data? If assembling that takes a day, say so internally before you write anything.
What proportion is company-issued? The number matters more than the policy, and contractors are usually where it drops.
What did your last ten offboardings actually take? Measure it. The reviewer will ask and a guess reads as one.
Do you hold a single wipe certificate? If not, that is the gap to close before the next questionnaire rather than during it.
Who owns the answers? One person, or two salespeople will answer the same question differently in two deals.
How teams prepare, and the trade-offs
Answer each one from scratch. Best for the first questionnaire and honest about where you are. It struggles immediately on repetition, and inconsistency between forms is a red flag reviewers watch for.
A spreadsheet answer library. Best value for most companies, especially with a date and an evidence link per row. It struggles when it is not maintained, because a stale yes is worse than no library at all.
A trust centre page. Best for deflecting the short forms entirely and good for sales velocity. It struggles with enterprise reviewers, who generally still want their own form completed.
Pursuing certification. Best for shortening every future review and sometimes required outright. It struggles on cost and lead time, and it does not help with the deal currently in front of you.
Closing the evidence gap at the device level. Disclosure: RemoAsset is owned by the same people who publish this site. It handles delivery, retrieval and certified wiping across 80 or more countries, which produces the per-device records that the offboarding and disposal questions ask for. Where it struggles: it will not answer your questionnaire, give you encryption management or provide a certification. The narrow part it covers is whether a sample wipe record exists to attach.
The decision table
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| No questionnaires yet | Any | No owner | Not a problem | Ignore until asked |
| First short form | Under 50 | Founder answers | Unsure what is true | Audit your own setup first |
| First enterprise review | 50 plus | One owner | Tempted to round up | Answer honestly, date the gaps |
| Mixed personal devices | Any | Any | Question does not fit | Split the answer by population |
| No evidence to attach | Any | Any | Policy without artefacts | Produce one sample record |
| Several per quarter | 100 plus | Security owner | Repetition and drift | A dated answer library |
What a rounded-up answer costs
The first cost is that it becomes a representation. Answers attach to contracts, and a yes that was mostly true is a statement you made in writing to win business. The exposure is not the security gap; it is the sentence.
The second is that reviewers probe the confident answers. Experienced ones can tell which lines were written carefully and which were filled in quickly, and the follow-up lands on exactly the item you hoped to pass over.
The third is contagion. One answer shown to be wrong changes how every other answer is read, and the review that would have taken a week takes a month. The device section is a common place for this because the facts are checkable.
There is a cost that lands on the team rather than the deal, and it shows up a quarter later. Somebody answers the offboarding question optimistically, the deal closes, and the customer’s contract now contains a timeframe nobody operationally agreed to. The first time a departure runs past it, the company is in breach of a commitment it made in a spreadsheet. Nobody set out to do that, and nobody is watching for it either.
The fifth is internal. Answers given in a deal rarely get fed back to the team who would have to make them true, so the gap stays open and the next questionnaire asks the same thing.
So the question is not whether you can get through the device section. It is whether the yes you wrote last quarter would survive somebody asking for the evidence this quarter.
The evidence you cannot write
Most of a questionnaire can be answered by writing something true. One part cannot, and it is the part that carries the most weight with a reviewer.
Three artefacts do most of the work. A list of devices with holders and serials. A record that a named machine was encrypted on a named date. And a wipe certificate for a specific device from a real departure. None can be produced retrospectively, which is why the preparation has to happen before the form arrives.
If you cannot produce the third, the honest answer to the offboarding question is weaker than your process probably deserves. That is a records gap rather than a security gap, and it is fixable in one cycle.
It is worth closing before the next deal rather than during one. Seeing how per-device records are generated through the lifecycle shows what a reviewer is hoping you can attach.
See what device handling evidence looks like
Read our guide to equipment compliance evidence
Related reading
- Evidencing equipment compliance
- Running a vendor security review
- The information security policy
- The asset management policy
- The offboarding policy
Frequently Asked Questions
What does the device section usually ask?
Whether you issue company equipment, whether it is encrypted and managed, how you handle loss, how you remove data when somebody leaves, and whether you can evidence all of that. Five themes in various wordings, and the last one is where most answers come apart.
Can we answer yes if it is mostly true?
No, and this is the most expensive mistake available here. An overstated answer becomes a contractual representation, and the reviewer will often ask for evidence on exactly the item you rounded up. Answer honestly with a date for the gap and you are usually fine.
What if we do not have device management?
Say so, describe what you do instead, and give a timeline if you plan to adopt it. Plenty of deals close with compensating controls clearly stated. Very few survive the discovery that an answer was wrong, because that changes how the reviewer reads every other line.
How do we answer the offboarding question?
With your actual process and your actual timeframe, not the one in your policy. The useful preparation is to measure your last ten departures before you answer, because a reviewer who asks a follow up will ask for exactly that number.
Do we need certifications to pass?
Not usually at the first stage. Certification shortens the conversation but a clear, honest set of answers plus evidence will carry most reviews for a small supplier. What loses deals is vagueness, since a reviewer cannot sign off on something they could not understand.
What evidence do they typically want?
A policy document, a screenshot or export showing a control is active, and a sample record such as a wipe certificate. The sample is the one small teams lack, because it is produced by a process rather than written by a person.
Should we keep our answers for reuse?
Yes, with the date and the evidence attached to each. The second questionnaire arrives faster than you expect and the answers drift if rebuilt from memory. A reviewed library also stops two people answering the same question differently in two different deals.
