Who should sign off answers to customer security questionnaires?
Someone who can confirm the answers are true, usually the security owner, with management aware of the important ones. In practice, questionnaire answers become part of the contract: a customer who relied on a “yes” that was not true may claim damages or end the contract after an incident. So answer for what is in place today, not what is planned, and say “partly”, with a short explanation, where that is the truth. Keep the evidence behind each yes in one folder, so the next questionnaire takes hours instead of weeks. Review the answers whenever something changes, such as a new supplier or a dropped tool. For questions on intrusion detection, NetSenX supplies concrete evidence: which segments are monitored, alert history, the audit log and data stored in the EU.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.