The Infosec Compliance Dossier: Evidence-Backed Answers to Your Customers' Security Questions
Clients and buyers routinely probe your information security via vendor security questionnaires—covering access rights, backups, disaster recovery, and third-party risk management. If your clients fall under NIS-2, the law requires them to manage security risks in their supply chain—and vendor questionnaires are how they do it. The Infosec Compliance Dossier gives you clean, structured answers—ready to use, without an expensive certification audit.
- Derived from real-world assessments: Built on over 2,000 questions across 27 sources, including BSI C5, VDA ISA, CSA CAIQ, and the BSI NIS-2 supply chain checklist. The dossier targets what enterprise procurement teams actually ask.
- 15 core documents, tailored to your work: from the security policy and access and contingency concepts to a ready-made Q&A catalog. Add-on modules cover special topics such as software development, IT/cloud operations, your own server room, or on-site work at customer premises.
- Evidenced, not just claimed: Every answer is backed by concrete documentation. If a document is missing, we build it together—turning an open question into verifiable evidence.
- Ready to import: You receive answers and documents as Excel and Word files that your IT team can import into your answer library, wiki, or compliance platform.
- A first step toward certification: The documents feed into a later ISMS under ISO/IEC 27001.
When You Need the Dossier
The dossier pays off as soon as a customer wants to know how you organize your information security. Typical use cases:
- A customer sends a vendor or security questionnaire before awarding a contract or as part of an annual supplier review.
- A customer covered by NIS-2 agrees security requirements for the supply chain with you.
- A customer in the automotive industry requires a VDA ISA self-assessment.
- A tender requires evidence of your information security.
- You run IT or cloud services for customers, and they ask about criteria such as BSI C5.
- Your management wants to know where the company stands on information security.
Examples of Information Security Questions
The following questions are among the most frequent in vendor and security questionnaires. For each, the dossier provides an answer and the matching document.
| Question | Evidence in the dossier |
|---|---|
| Do you operate an ISMS under a recognized standard, and does it cover the services you provide to us? | Security Policy and Organization, Evidence Folder |
| Are access rights granted on a need-to-know basis and reviewed regularly? | Access and Authorization Concept |
| Do you have password rules and multi-factor authentication (MFA)? | Access and Authorization Concept |
| Is your network segmented and protected by firewalls? | Technical Safeguards |
| Is data encrypted in transit? | Technical Safeguards |
| Are vulnerabilities rated by risk and patches applied within set deadlines? | Operating Procedures |
| Do you run regular independent penetration tests? | Evidence Folder, Action Plan |
| Is data backed up, and are restores tested? | Backup and Business Continuity |
| Will you notify us of security incidents within fixed deadlines? | Incident Management |
| How do you assess your own service providers? | Suppliers and Service Providers |
The 15 Core Documents
Every company that wants to answer its customers' security questions with evidence needs these documents.
| Document | Content |
|---|---|
| Security Policy and Organization | Defines the scope, contains the policy approved by management, and names roles and responsibilities with contacts and an emergency contact. |
| Inventory and Classification | Records hardware, software, data, and services with owners and country of processing, and assigns each entry a protection level. |
| Risk Assessment | Evaluates information security risks with mitigations and residual risk, and sets when the assessment is repeated. |
| Security Rules for Employees | Covers the use of devices, email, and the internet, remote work, screen locking, and how to report anything suspicious. |
| Access and Authorization Concept | Covers accounts, passwords, and MFA, granting rights based on need, revoking them, and reviewing them regularly. |
| Technical Safeguards | Describes the network plan and firewalls, protection against malware and phishing, incident detection, hardening, encryption, and endpoint management. |
| Operating Procedures | Sets out how changes are planned, how vulnerabilities are rated, and how patches are applied within deadlines. |
| Backup and Business Continuity | Describes the scope, frequency, and separate storage of backups, restore tests, and what to do in an emergency. |
| Incident Management | Sets out who does what in a security incident, how incidents are classified, and when and how customers are notified. |
| Suppliers and Service Providers | Lists your service providers with their tasks, data, and countries, and records how you assess them before and after you engage them. |
| Personnel | Covers confidentiality commitments, the training plan with attendance records, and the return of devices when employees leave. |
| Physical Security | Covers access to offices and server rooms, keys and visitors, and the secure erasure and destruction of storage media. |
| Evidence Folder | Collects existing certificates, audit reports, and internal audits with their scope in one place. |
| Action Plan | Tracks open action items with owners and target dates, turning a critical "No" into a verifiable "Planned by …". |
| Q&A Catalog | Answers the usual security questions in customer questionnaires in German and English and refers each answer to the matching document. |
The Four Add-On Modules
Depending on what your company does, customers ask about special topics as well. The add-on modules cover them.
| Add-on module | When you need it and what it contains |
|---|---|
| Secure Development and Product Security | If you develop or deliver software or digital products: a secure development process, testing, protection of web applications and APIs, and separation of development, test, and production environments. |
| Operation of IT and Cloud Services | If you run IT or cloud services for customers: architecture and data flows, separation of customer data, your staff's access to customer data, key management, redundancy, and availability. |
| Server Room and Data Center | If you run your own server room or data center: power, cooling, and network, protection against fire and water, and maintenance and test records. |
| Work at Customer Sites | If your employees access customer systems or premises: rules for access, a list of authorized persons, and on-site conduct. |
Frequently Asked Questions
We Are Certified Under ISO 27001. Do We Still Need the Dossier?
Then the effort is much smaller. Most of the evidence already exists in your ISMS. The dossier maps it to your customers' questions, closes gaps—for example, sites or services outside your certified scope—and delivers the Q&A catalog in German and English. That way you answer questionnaires faster and consistently.
Will Customers Accept a Self-Declaration Without a Certificate?
Whether a customer accepts your answers is the customer's decision. The dossier provides what buyers value most in supplier assessments: an answer with traceable evidence. Where an answer is "No" today, the action plan shows by when and by whom the gap will be closed. If a customer explicitly requires a certificate, the dossier is the first step toward an ISMS under ISO/IEC 27001.
Does the Dossier Fulfill Our NIS-2 Obligations?
No, not on its own. The dossier answers your customers' questions. If your own company is covered by NIS-2, Section 30 of the German BSI Act (BSIG) requires ongoing risk management with reporting channels, management training, and regular review. Many of the dossier's documents are a good basis for this, but they do not replace day-to-day operation. The whitepaper "Implementing NIS-2 on the Basis of ISO 9001" describes how to implement NIS-2 on the basis of an existing ISO 9001 system.
How Much Effort Will This Require From Our IT Team?
More than for the AI Compliance Dossier, because most answers lie with your IT team or your IT service provider. I do most of the work: I collect existing documents, run short interviews on each topic, and write the documents. Your IT team reviews the results. The written proposal states the exact scope.
What Does the Dossier Cost, and When Will It Be Ready?
After the initial discovery call, you receive a written proposal with a fixed price and a delivery date. The price depends on how much security documentation already exists and which add-on modules your business requires.
We Also Need the AI Compliance Dossier. What Then?
The two dossiers share several documents, for example the inventory, risk assessment, roles, training plan, action plan, and Q&A catalog. If you book both, I create these documents once for both dossiers and charge for them only once.
Are Data Protection and Contracts Included?
No. The Q&A catalog answers questions on data processing agreements, records of processing activities, or deletion policies with a reference to your data protection documents and your data protection officer. Contract clauses, for example on audit rights or liability, are reviewed by your legal counsel; legal advice is not part of the dossier.
In Which Language Will We Receive the Answers?
You receive the Q&A catalog in German and English, so you can also answer English-language questionnaires without translation effort.
Why Does the Infosec Compliance Dossier Need to Be Updated Every Year?
Four factors change constantly and require an annual review:
- New systems and service providers: additional software, new cloud services, and changed contracts with service providers.
- New threats and vulnerabilities: the risk assessment and safeguards must match the current state.
- New questionnaire versions: Common catalogs such as BSI C5 or VDA ISA are regularly released in new versions.
- Staff turnover: New employees need confidentiality commitments and training records.
I offer the annual update of the documents as a separately bookable annual package.
Free whitepaper: "Implementing NIS-2 on the Basis of ISO 9001"—for companies with an existing quality management system
Contact
Send me the questionnaire you have on your desk, or write briefly what it is about. I will get back to you with a suggested date for an initial call. If you wish, we sign a confidentiality agreement beforehand.