Mateo Fernandez Advisory memo Decision Call · USD 250
Should you answer Bexley's security questionnaire as-is?
60 minute call, 14 October. Reviewed and signed off by Mateo Fernandez on 16 October.
You asked whether to send the questionnaire back with nine honest No answers, or to delay two weeks and fix three of them first. The answer is neither, and the reason is that two of your nine No answers are not actually No.
Delaying two weeks to fix controls will not help: Bexley's process scores the questionnaire on completeness and evidence, not on a perfect score, and a late submission drops you out of this procurement round entirely. Two of your nine No answers should be Yes with evidence you already hold. Send on Friday with those corrected and a dated remediation plan against the rest.
The question
What was asked, and what was reviewed
The question as you put it on the call: "Do we send this back now with nine No answers and look weak, or delay two weeks, fix what we can and look slower?"
| Reviewed | Source | Status |
|---|---|---|
| Bexley security questionnaire, 40 questions | Supplied by you, 13 October | Read in full |
| Your draft answers | Supplied, 13 October | Read in full |
| Cloud configuration export | Supplied | Reviewed |
| Identity provider policy report | Supplied | Reviewed |
| Your incident register | Supplied, two entries | Reviewed |
| Bexley's published supplier standard | Public, their website | Read |
| Bexley's scoring method | Not published | Inferred, see clause 4 |
| Your actual control effectiveness | Not tested | Out of scope |
The finding
Two answers are wrong in your own favour
You have answered No to two questions that your own evidence answers Yes. This is more common than the reverse and it is expensive.
| Q | Question | You said | Should be |
|---|---|---|---|
| Q14 | Is data encrypted at rest using industry standard algorithms? | No | Yes. Your cloud export shows AES-256 on all six stores |
| Q27 | Do you maintain an incident response capability? | No | Yes, qualified. You have a register and a named person, and no written plan |
| Q31 | Do you hold ISO 27001 or SOC 2? | No | No. Correct |
| Q33 | Has a penetration test been performed in the last 12 months? | No | No. Correct |
Q14 is a straightforward error: you read it as asking about a formal encryption policy, which you do not have, rather than about encryption, which you do. Q27 is a judgement call, and the honest answer is a qualified Yes with the gap stated, not a No.
Options
The three routes, and what each costs
| Send Friday, corrected | Delay two weeks | Send as drafted | |
|---|---|---|---|
| Meets the 23 October deadline | Yes | No | Yes |
| Answers are accurate | Yes | Yes | No, two are wrong |
| Number of No answers | 7 | 5 | 9 |
| Engineering time needed | About 3 hours | 2 weeks of one engineer | None |
| Stays in this procurement round | Yes | No | Probably |
| Position for the next round | Good | Good, but a round later | Weak |
The two week option is the one that feels most responsible and is the worst of the three. Bexley's RFP schedule is published and the security questionnaire gates entry to the shortlist; a supplier who misses it is not assessed late, they are not assessed.
Uncertain
What I do not know
The recommendation rests on three things I could not verify, and you should know which they are.
| Assumption | Basis | If wrong |
|---|---|---|
| Bexley scores on completeness and evidence, not on a threshold | Inferred from their published supplier standard and from how comparable buyers score | A hard threshold on ISO 27001 would exclude you regardless. Ask them |
| The 23 October deadline is firm | Stated in their pack. Not confirmed with their procurement contact | If it moves, the two week option becomes viable |
| Your cloud export reflects production | You said so. I did not test it | Answering Yes to Q14 on a wrong export is worse than answering No |
Next
What to do, in order
- Today: ask Bexley's procurement contact two questions. Is there a minimum score, and is 23 October firm? Both are reasonable questions and asking them does not weaken you.
- Tomorrow: engineer confirms the production encryption configuration in writing.
- Wednesday: correct Q14 to Yes with the export referenced, and Q27 to a qualified Yes naming the register, the named responder and the absence of a written plan.
- Thursday: write a one page remediation plan with dates against the remaining seven. Dates you will actually hit, not dates that sound good.
- Friday: send. Do not wait for Monday.
- Nothing in the submission should say a control exists when it does not
- Every date in the remediation plan should be one you would be content to be asked about in January
- Keep the questionnaire. The next enterprise buyer asks 80 percent of the same questions