AWS security questionnaire: answers and evidence

Published 2026-10-24, updated 2026-11-05

Sooner or later a bigger customer sends a security questionnaire, and a deal waits on it. Most of the AWS questions come down to the same dozen facts. Here they are, with where to find the answer and the evidence to attach.

Access control

• "Is MFA enforced for all administrative access?" Root user MFA, MFA on every console user, single sign-on with MFA if you use it. Evidence: the IAM credential report, or a summary of it.
• "How often do you review user access?" Monthly is the usual expectation. Evidence: your last signed-off access review.
• "How do you remove access when people leave?" A leaver checklist tied to your HR or identity process. Evidence: the checklist and a recent leaver's record.
• "Is the principle of least privilege applied?" Who has administrator rights, and why. Evidence: the list of admins.

Data protection

• "Is customer data encrypted at rest?" EBS default encryption on, encrypted databases and buckets. Evidence: a check showing no unencrypted storage.
• "Is data encrypted in transit?" TLS on load balancers and endpoints, with old policies removed.
• "Is any data publicly accessible?" S3 Block Public Access on; no public buckets, snapshots, images or databases. Evidence: a dated check.
• "Where is data stored?" The regions you use, ideally limited to the ones you need.
• "Are backups taken and tested?" Backup retention on databases, point-in-time recovery, and when you last restored one.

Network security

• "Are administrative ports exposed to the internet?" No security group open to the world on SSH, RDP or database ports. Evidence: a list of what is open, and why.

Logging and monitoring

• "Are audit logs kept?" CloudTrail logging every region, kept for a year or more, protected from deletion.
• "Do you monitor for threats?" GuardDuty on, with someone receiving its findings.

Vulnerability and patch management

• "Are systems kept up to date?" Supported Lambda runtimes and database versions, patched instances, certificates renewed in time.

If the questionnaire is built on CIS AWS Foundations, ISO 27001 or SOC 2 rather than free-text questions, Strays (on the Business plan) can lay the same evidence out by control, with a pass or fail for each AWS account. It covers the AWS technical controls only: the policies, people and process parts of those frameworks are still yours to evidence.

Answer once, reuse every time

Keep your answers and evidence in one document, dated, and refresh it when something changes. Questionnaires differ in wording, not in substance: once you have the twelve facts above, most AWS sections take minutes, not days.