Answering a vendor WiFi security questionnaire: a checklist with the evidence to attach

Use this to scope a vendor WiFi security questionnaire. At 60 questions and 70% reusable evidence, it returns 14.5 hours of work. Of those questions, 18 need fresh evidence. The checklist maps each question to the artifact to attach, from authentication settings and access logs to ISO 27001 certificates and PCI DSS segmentation records.

What does this WiFi security questionnaire tool return?

A vendor WiFi security questionnaire reaches the network team with a deadline and little context. It might come from a corporate client, a payments partner, an insurer, a franchisor or your own procurement team. The questions repeat from one review to the next. The evidence, though, sits in several consoles and several inboxes.

This tool turns that into a plan. It has two parts, and each returns something you can act on:

• The effort calculator returns three things: the hours to complete the WiFi section, the number of questions that need fresh evidence, and the hours your standing evidence pack saves.
• The evidence checklist returns the artifacts to keep on file, grouped by network. Most answers then become a lookup rather than a project.

Every question maps to one of three networks, or to governance:

• The open network carries guests and bring your own device (BYOD) onboarding. They join through a captive portal, the web page that gates access before a device joins.
• The secure network carries staff on IEEE 802.1X, the standard that makes each device authenticate before it gets an address.
• The xPSK network gives each device or resident its own pre-shared key. One leaked key never exposes everyone else.

On all three networks, identity sets the VLAN, the logical network segment a device lands on.

{"kind":"flow","direction":"lr","caption":"How a WiFi security questionnaire moves from arrival to a fuller evidence pack","alt":"A flow from questionnaire arrival through tagging, evidence matching, fresh capture and sign-off, looping back to refresh the standing pack.","nodes":[{"id":"a","label":"Questionnaire arrives","sub":"From a client, insurer, partner or auditor","tone":"neutral"},{"id":"b","label":"Tag each question","sub":"Open, secure, xPSK or governance","tone":"brand"},{"id":"c","label":"Match to the standing pack","sub":"Dated exports, screenshots, certificates","tone":"brand"},{"id":"d","label":"Capture fresh evidence","sub":"Sampled sites, leaver test, segmentation proof","tone":"neutral"},{"id":"e","label":"Owner reviews and signs","sub":"Each answer cites the evidence attached","tone":"neutral"},{"id":"f","label":"Return and refresh the pack","sub":"New artifacts join the pack for next time","tone":"success"}],"edges":[{"from":"a","to":"b"},{"from":"b","to":"c"},{"from":"c","to":"d","label":"gaps"},{"from":"c","to":"e","label":"covered"},{"from":"d","to":"e"},{"from":"e","to":"f"},{"from":"f","to":"c","label":"next review","style":"dashed"}]}

That loop is the point. Each questionnaire you answer should leave the pack fuller, so the next one costs less.

The evidence comes from consoles you already run:

• Cisco Meraki Dashboard
• HPE Aruba Central
• Ruckus SmartZone
• Juniper Mist
• The Ubiquiti UniFi Network application

Alongside those, Purple Access gives you visibility and reporting across the open, secure and xPSK networks.

How do I use the calculator and the evidence checklist?

Start with the calculator. Count the questions in the WiFi section. Then estimate the share you can answer from evidence you already hold, dated within the last quarter. Be honest on that second input. An undated screenshot from last year is not reusable evidence.

{"title":"WiFi security questionnaire effort calculator","intro":"Enter the size of the WiFi section and how much your standing evidence pack covers. It returns the hours to answer, the questions needing fresh evidence and the hours the pack saves.","inputs":[{"id":"questions","label":"WiFi questions in the questionnaire","unit":"questions","default":60,"min":5,"max":400,"step":1},{"id":"reuse","label":"Share answerable from your dated evidence pack","unit":"%","default":70,"min":0,"max":100,"step":5},{"id":"reusetime","label":"Minutes per question answered from the pack","unit":"min","default":6,"min":1,"max":60,"step":1},{"id":"freshtime","label":"Minutes per question needing fresh evidence","unit":"min","default":30,"min":5,"max":240,"step":5},{"id":"sites","label":"Sites the reviewer samples","unit":"sites","default":4,"min":0,"max":50,"step":1},{"id":"sitetime","label":"Minutes of evidence capture per sampled site","unit":"min","default":20,"min":5,"max":120,"step":5}],"outputs":[{"id":"hours","label":"Hours to complete the WiFi section","expr":"(questions*reuse/100*reusetime+questions*(100-reuse)/100*freshtime+sites*sitetime)/60","format":"decimal1","unit":"hours"},{"id":"fresh","label":"Questions needing fresh evidence","expr":"ceil(questions*(100-reuse)/100)","format":"int","unit":"questions"},{"id":"saved","label":"Hours saved by the standing pack","expr":"questions*reuse/100*(freshtime-reusetime)/60","format":"decimal1","unit":"hours"}],"example":"At 60 questions, 70% reusable, six and 30 minutes per answer and four sampled sites at 20 minutes each, the result is 14.5 hours, 18 questions needing fresh evidence and 16.8 hours saved.","assumptions":["Time figures are illustrative planning estimates, not Purple benchmarks: replace them with your own.","Reusable means dated within the last quarter and owned by a named person.","Site time covers console screenshots and one sample log export.","Reviewer follow-up rounds are not included."]}

Next, work through the checklist. It is your standing evidence pack, grouped by network. Download it as a CSV and assign an owner to each row. Then record the date each artifact was last captured.

{"title":"Standing WiFi evidence pack","groups":[{"heading":"Governance and supplier evidence","items":[{"text":"Purple ISO 27001 certificate and scope statement"},{"text":"Purple Cyber Essentials certificate"},{"text":"Data processing agreement covering captive portal data under CCPA/CPRA"},{"text":"Network diagram of SSIDs, VLANs and internet breakout, dated this quarter"}]},{"heading":"Secure network: staff","items":[{"text":"Console screenshot of the staff SSID set to WPA2- or WPA3-Enterprise with 802.1X"},{"text":"RADIUS policy export showing EAP-TLS and the VLAN returned per group"},{"text":"Identity provider connection: Microsoft Entra ID, Okta or Google Workspace"},{"text":"Dated leaver test: account disabled, access revoked, both timestamps captured"},{"text":"RADIUS server certificate expiry date and renewal owner"},{"text":"MDM profile that delivers device certificates"}]},{"heading":"xPSK network: devices and residents","items":[{"text":"Key inventory export: one key per device or resident, with its VLAN"},{"text":"Revocation record for a removed key"},{"text":"Rotation rule for keys on headless devices such as scanners and signage"}]},{"heading":"Open network: guests and BYOD","items":[{"text":"VLAN and firewall rules showing guests cannot reach staff or payment networks"},{"text":"Client isolation setting from the access point console"},{"text":"Captive portal consent wording and one sample consent record"},{"text":"Latest PCI DSS segmentation test result, if the estate takes cards"}]},{"heading":"Logging and monitoring","items":[{"text":"Sample authentication log export from Purple Access, with timestamps"},{"text":"Stated log retention period and the SIEM that receives the logs"},{"text":"Rogue access point report from your controller"},{"text":"Named incident contact and escalation route"}]}],"download":{"filename":"wifi-questionnaire-evidence-pack.csv"}}

The checklist uses a few terms worth defining:

• RADIUS (RFC 2865) is the protocol that carries authentication requests from the access point to the server.
• EAP-TLS (RFC 5216) authenticates each device with a certificate rather than a password.
• MDM is mobile device management, the system that pushes those certificates to devices.
• SIEM is your security information and event management platform.

Delete the groups for networks you do not run. With no xPSK network, those three rows go. Any xPSK questions then become "not applicable" with a one-line reason.

{"tone":"warning","title":"Redact before you attach","text":"Strip RADIUS shared secrets, pre-shared keys and certificate private keys from every export and screenshot. A questionnaire response often travels well beyond the reviewer who asked for it."}

Worked example: a 60-question review for a 140-store retailer

The property portfolio below is illustrative, not a named Purple customer. It is a retail group with 140 stores on Cisco Meraki and a corporate office on HPE Aruba. A payments partner sends a vendor security assessment with a 60-question WiFi section.

The group runs all three networks:

• Open: shoppers join through a captive portal, on their own VLAN.
• Secure: staff join with EAP-TLS against Microsoft Entra ID.
• xPSK: handheld scanners and digital signage each have their own key.

Input	Value	Basis
WiFi questions	60	Counted from the questionnaire
Share answerable from the pack	70%	42 questions matched to dated artifacts
Minutes per reused answer	6	Paste, check the date, name the owner
Minutes per fresh answer	30	Capture, redact, write, review
Sampled sites	4	Three stores and corporate office
Minutes per sampled site	20	Console screenshots plus a log export

At those inputs, the calculator returns 14.5 hours:

• The 42 reused answers take 4.2 hours.
• The 18 fresh answers take nine hours.
• The four sampled sites add about 1.3 hours.

Without the pack, the same section would take 31.3 hours. The pack saves 16.8 hours on this one review.

Which 18 questions needed fresh evidence? In this example, most were site-specific or newly worded. The reviewer wanted three things the pack did not hold:

• A dated offboarding test.
• Guest-to-payment segmentation proof for the sampled stores.
• A written log retention period.

The table below maps typical questions to the evidence attached. Download it and add your own reviewers' wording.

{"caption":"Common WiFi questionnaire questions and the evidence to attach","asOf":"2026-06-10","columns":[{"key":"q","label":"Question as reviewers phrase it"},{"key":"net","label":"Network"},{"key":"ev","label":"Evidence to attach"}],"rows":[["Is wireless access authenticated per individual?","Secure","SSID screenshot showing 802.1X; RADIUS policy export showing EAP-TLS"],["Are shared WiFi passwords in use?","xPSK, secure","Key inventory showing one key per device; staff on 802.1X"],["How are leavers removed from WiFi?","Secure","Dated leaver test and identity provider record"],["Is guest traffic separated from internal systems?","Open","VLAN map, firewall rules and client isolation setting"],["Can WiFi reach the cardholder data environment?","All three","Latest PCI DSS segmentation test result"],["Which encryption protects corporate WiFi?","Secure","SSID security setting: WPA2- or WPA3-Enterprise"],["How long are WiFi access logs retained?","All three","Written retention period plus sample log export"],["Do you detect rogue access points?","All three","Rogue access point report from the controller"],["How is personal data from guest WiFi handled?","Open","Captive portal consent wording and processing agreement"],["What certifications does your WiFi provider hold?","Governance","Purple ISO 27001 and Cyber Essentials certificates"]],"footnote":"Each answer describes a control and attaches evidence for it. The judgment on whether a standard is met belongs to the assessor.","download":{"filename":"wifi-questionnaire-question-map.csv"}}

Look at the wording in the evidence column. Each answer describes a control and attaches evidence for it. None claims the estate meets a standard outright. That keeps your answers defensible if the reviewer follows up.

How is the 14.5-hour figure built?

The calculator adds three blocks of work, then divides by 60 to convert minutes to hours:

1. Reused answers: questions × reuse share × minutes per reused answer. At the defaults, 42 × 6 = 252 minutes.
2. Fresh answers: questions × (100% - reuse share) × minutes per fresh answer. At the defaults, 18 × 30 = 540 minutes.
3. Sampled sites: sites × minutes per site. At the defaults, 4 × 20 = 80 minutes.

The total is 872 minutes, or 14.5 hours. The fresh-question count rounds up, because a partly covered question still needs its own evidence.

The hours-saved output prices reused answers as if they were fresh: 42 × (30 - 6) ÷ 60 = 16.8 hours. Add 16.8 to 14.5 and you get the 31.3-hour cost of answering from scratch.

The reuse share is the lever:

• At 60 questions, each 10 points of reuse saves 2.4 hours.
• Raising reuse from 70% to 90% takes the section from 14.5 hours to 9.7.
• Sampled sites barely move the total, unless the reviewer wants evidence from many locations.

All time figures are planning estimates for this example, not Purple benchmarks. Replace them once you have timed a real questionnaire. Share the assumptions if a reviewer asks how you set the response date.

{"tone":"tip","title":"Time the next one","text":"Note the minutes you spend on each answer in your next questionnaire. Feed those figures into the calculator and your estimates stop being guesses."}

How do I adapt the checklist to my estate?

Set the inputs from the document in front of you

Count the WiFi questions in the actual questionnaire rather than guessing from its title. Standardized forms and bespoke client reviews differ widely in length. Set the reuse share only after you have matched each question to a dated row in the checklist.

Multi-vendor estates

Plan one sampled site per console, because reviewers often want a screenshot from each platform. An estate on Cisco Meraki and HPE Aruba needs at least two. Add Juniper Mist or Ubiquiti UniFi sites and the input rises with them.

The settings to capture are the same in every console:

• The SSID security mode.
• The RADIUS server the SSID points at.
• Dynamic VLAN assignment, which uses the RADIUS tunnel attributes in RFC 3580.

Franchise and managed estates

Where franchisees own the access points, central evidence covers only the policy. Lower the reuse share for site questions and raise the sampled-site minutes. Franchisee screenshots take longer to collect.

Verticals change the networks in scope

The networks that matter depend on who connects:

• Hospitality: guests sit on the open network and staff on the secure network. Whitbread runs segmented staff WiFi on Purple.
• Multi-tenant estates such as Multi-Family (MDU) and Student Housing: residents usually sit on xPSK. Expect questions on resident-to-resident isolation.
• Retail: reviewers focus on PCI DSS segmentation between the shopper network and payment systems.
• Healthcare: patients and visitors sit on the open network. Clinical devices often sit on xPSK.

Keep a wording column per reviewer

Add a column to the downloaded CSV for each reviewer's phrasing. Different reviewers ask the same question in different words. Mapping their phrasing to one artifact is what lifts your reuse share next time.

What should I do with the result before the next review?

Read the hours output against three bands:

• Under 10 hours: the pack is healthy. Refresh the dated rows each quarter.
• Between 10 and 20 hours: look at where the fresh questions cluster, by network.
• Over 20 hours: the pack is thin, or one network has a structural gap that no screenshot can cover.

If fresh questions cluster on the staff network, check whether it runs on a shared passphrase. A shared key cannot evidence individual access or a clean leaver removal.

The fix needs no new hardware:

1. Move staff to Staff WiFi on the secure network.
2. Set the SSID to WPA2- or WPA3-Enterprise.
3. Point it at Purple's cloud RADIUS.
4. Let the identity provider decide the VLAN.

Our guide to 802.1X for multi-site restaurant groups walks through that rollout across hundreds of locations. MDM setup for device certificates takes five to ten minutes, once, for the whole organization.

{"tone":"proof","text":"McDonald's saw 80% fewer IT helpdesk requests with Purple. JPMorgan runs staff WiFi on Purple across 5,000 branches, and Whitbread runs segmented staff WiFi on Purple."}

Two more checks belong on the list:

• Certificate expiration dates. An expired RADIUS server certificate locks staff out and turns a passed review into an incident. Our guide on a RADIUS server certificate that has expired covers recovery. Add the renewal date to the pack.
• The wider picture. For your security posture beyond the questionnaire, read the enterprise WiFi security guide.

Frequently asked questions

Does this work with the access points we already own?

Yes. Purple Access runs as a cloud overlay on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. You point the SSID's RADIUS settings and captive portal at Purple in the console you already use. No new hardware is needed. The screenshots in your evidence pack come from the same consoles your team opens every day. Purple runs across 80,000+ venues in 90 countries.

How should we word answers about PCI DSS and CCPA/CPRA?

Describe the control, then attach the evidence for it. Write "guest traffic sits on a separate VLAN with no route to the payment network; segmentation test attached". Avoid a blanket statement that you meet the standard. The assessor decides whether a requirement under CCPA/CPRA or PCI DSS is met. Your job is to make that judgment quick, with dated evidence and a named owner for each answer.

How long does it take to build the standing evidence pack?

About as long as one questionnaire answered from scratch. At the calculator's defaults, that is 31.3 hours for 60 questions with no reuse, including four sampled sites. After that, each review costs the 14.5-hour figure or less. A quarterly refresh of the dated rows keeps it there. If staff certificates come from your MDM, setup takes five to ten minutes, once, for the whole organization.

What does Purple Access cost?

Pricing is quoted for your estate, based on the networks you run and the number of venues in scope. Bring this tool's outputs to the conversation: your site count, the networks behind your fresh questions and the hours each review takes. That gives you a clear view of the team time Purple returns against the subscription.

Do we need to replace our RADIUS server to answer these questions?

No. You can answer with evidence from whatever authenticates staff today. If the fresh column keeps filling with certificate renewals, server patching or missing leaver records, Purple's cloud RADIUS takes that on-premises work off your estate. Our guide to Cisco ISE alternatives sets out what to compare when you weigh the move.

How do we evidence leaver removal across hundreds of sites?

Run one dated leaver test and attach the identity provider record. Staff on 802.1X authenticate against Microsoft Entra ID, Okta or Google Workspace. Disabling the account there means Purple revokes WiFi access across the estate, not one site at a time. Joiners, movers and leavers all flow from the directory. The single test therefore stands as evidence for every location.

Does DNS filtering belong in the WiFi section?

Yes, when reviewers ask what stops guest devices reaching harmful sites. DNS filtering on Purple is Shield, a security add-on, so attach its policy summary alongside the open network evidence. Keep that answer separate from authentication questions. Filtering governs where traffic goes. 802.1X and xPSK govern who joins and which VLAN they land on.

Can we reuse the same pack for a customer security review and an insurer?

Yes. Most evidence carries across, because both reviewers ask who can join, what they can reach and how you know. Keep a column in the CSV for each reviewer's wording and map it to the same artifact. Only the sampled sites and capture dates change between reviews. Then hold your SOC 2 Type II and ISO 27001 certificates centrally for every request.