Security Policies and Audit Readiness: What to Have Ready When a Customer Asks

Updated October 2026 to our current guidance. The original reporting date is unchanged.

Has anyone asked you to prove your security lately: an insurer, a client, an auditor?

For most small businesses the first request is not from a regulator. It is a security questionnaire from a bigger customer, attached to a contract renewal. It asks who can reach your data, how fast you install security updates, what happens when something goes wrong, and whether you can show it in writing. An insurer’s renewal form asks much the same.

You probably do most of these things already. The questionnaire asks for the written version, and the records that show you do it.

Security policies are those written rules. Getting them right lowers your actual risk and lets you answer the questionnaire in an afternoon instead of a week.

Who asks, and what they want

The customer and the insurer

A larger customer sends a questionnaire because you are part of its supply chain. If your systems go down or your accounts are misused, their work stops too. Their questions are about availability as much as secrecy: can you keep shipping, and can you recover if a computer fails?

Insurers ask for proof of two-step sign-in, backups that have actually been restored, and security updates on a schedule.

The regulations that may apply

Some businesses also fall under a formal framework. As of March 2026, these were the common ones:

A customer questionnaire often borrows its questions from one of these, so the same policies tend to answer both.

Who is responsible for what

Policies set expectations for everyone:

• Owners and executives decide which risks the business accepts.
• Whoever runs your IT, inside or outside the company, knows the technical controls to keep in place.
• Employees know the rules for handling data, passwords, company systems, and reporting problems.
• Vendors know what you expect of them before they connect to your systems.

Without written policies, nobody can say for sure who was supposed to do what.

Core IT security policies to have

A minimum set

• [ ] Acceptable use: what employees can and can’t do with company systems and data
• [ ] Access control: who gets access to what, how access is granted and removed, and least privilege
• [ ] Passwords and sign-in: password requirements, two-step sign-in, and password manager use
• [ ] Data classification and handling: how to sort data by sensitivity and handle each level
• [ ] Incident response: what to do when something goes wrong, including who to call and how to contain it
• [ ] Change management: how changes to systems are proposed, approved, tested, and recorded
• [ ] Patch management: how soon security updates go in, by severity, and who installs updates for programs Windows Update doesn’t cover
• [ ] Backup and recovery: what is backed up, how often, and when a restore was last tested
• [ ] Remote work and personal devices: requirements for remote access and personal phones or laptops
• [ ] Vendor management: security requirements for the companies you rely on
• [ ] Data retention and disposal: how long data is kept and how it is destroyed

Email policies

Most questionnaires ask about email, so cover it:

• [ ] What to do with a suspicious email: don’t click, don’t open attachments, report it
• [ ] How to verify unexpected requests by email, especially money transfers or sensitive data, using a phone number you already have
• [ ] Who to send a suspicious message to for a second look before anyone acts on it
• [ ] Encryption requirements for sensitive data
• [ ] Acceptable use of email for business

Getting ready for an audit or a questionnaire

What reviewers look for

Whether it is an auditor or a customer’s security team, they want the same things: policies that are written, approved, and dated, and evidence that you actually do what the policies say, over time rather than once.

Your documentation package

• [ ] Policy documents: current versions with approval dates and review history
• [ ] System Security Plan (SSP): your environment and how you meet each requirement
• [ ] Plan of Action and Milestones (POA&M): known gaps and your dates for closing them
• [ ] Risk assessments: periodic reviews of threats and weak spots
• [ ] Training records: proof that employees completed security training
• [ ] Access review logs: records of periodic reviews of who has access to what
• [ ] Patch records: evidence that updates go in on schedule, for third-party programs as well as Windows
• [ ] Software inventory: what is installed on each computer, and which programs are current
• [ ] Backup and restore records: dates of the last successful test restore
• [ ] Incident records: what happened and how it was handled
• [ ] Configuration records: baselines and change logs
• [ ] Vendor security reviews: how you checked the companies you rely on

A preparation checklist

• [ ] Review and update all policies at least once a year, or after a big change
• [ ] Give every policy an owner who is responsible for it
• [ ] Have employees acknowledge that they read the policies
• [ ] Do a self-assessment before the external review
• [ ] Collect the evidence (logs, screenshots, reports) in one place
• [ ] List any gaps in your POA&M with realistic dates
• [ ] Make sure your documents match what you actually do, because reviewers check

Common mistakes

• Policies that nobody follows. A policy sitting in a shared folder gives a confidence that the records won’t back up.
• Policies that haven’t been updated in years. If the remote work policy still talks about “occasional telework,” it is out of date.
• No evidence trail. You say access reviews happen every quarter, and there is no record of one.
• Scope that misses part of the business. The policies cover the main office but not the cloud accounts or the people working from home.
• Treating it as a one-time project. Reviews, training, and monitoring are ongoing, and a customer will ask again next year.

Tools that help

Where to start

Most of what a questionnaire asks, you can answer from policies and records. One question tends to stop people: which programs are on your computers, and are they current? Windows Update never touches third-party software, so the PDF reader, the file tools, and the specialty apps each update on their own schedule, or not at all. Nobody did anything wrong. That is just where Windows Update’s job ends.

So who has been checking the rest? Before you look, guess how many programs are on one of your computers and write it down. Then count.

Count What’s on Your Computers → See how many programs each Windows PC has, how many are current, and how many need updating. No credit card needed. The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.

If the second number is bigger than you expected, that is common. You don’t have to be able to do this. We’ll do it with you. And if you run it and never speak to us again, that’s a fine outcome.

Then start with the core policies, build the records as you go, and review them once a year.