who is responsible for filling in customer questionnaires about security

Responsibility lies with the role, not the department

There is no statutory indication of who in the company must complete the security questionnaire — that is internal policy, not an obligation under any regulation. In practice, it falls to whoever can substantiate the answer: often the IT manager or security officer for technical measures, and HR or management for policy and awareness. With ISO 27001 certification, this is usually already laid down in the role allocation around the information security management system, and then the questionnaire is a matter of consulting that system, not of re-establishing it.

Where things often go wrong is not the question of who completes it, but the question of who may approve it. A technical answer may be correct, but if the person who enters it has no view of what may be shared with an external party, information is released that should not go there. That is a reason to view completion and release as two separate steps: the first is factual, the second is an assessment of confidentiality. That same distinction applies for example to the question whether the undertaking has a business continuity plan — there too the answer is often known, but not always intended to be shared in detail.

What the questionnaire substantively tests

The ten measures of Article 21(2) of the NIS2 Directive (Directive (EU) 2022/2555) give a good picture of the categories that appear in customer questionnaires: risk analysis, incident handling, business continuity, supplier security, access policy and the like. Those who apply ISO/IEC 27001 recognise the same subjects in the control measures of Annex A — that makes the standard a useful internal reference work, even if the certificate itself is not shown to the customer. For the question whether the undertaking is ISO 9001-certified the same logic applies: it concerns a separate standard, but the question of who knows and manages the answer often lies organisationally with the same person.