A client sent us a security questionnaire. How do we answer it?

What these questionnaires ask about

They ask how you protect the systems that touch the client's information. The wording changes from client to client, but expect questions in these areas:

• How your computers are protected and kept up to date.
• Whether you keep a list of your computers and software.
• Whether laptops and stored data are encrypted.
• How incoming email is filtered.
• Whether every account uses multi-factor sign-in.
• Whether your data is backed up, and whether you can restore it.
• Whether your team has security training, especially anyone with administrator access.
• Who has administrator access, how access is removed when someone leaves, and how often you review who has access.
• Whether you have written security policies.
• Which other companies handle the client's data for you, and where it's stored.
• What you would do if something went wrong, whether that plan is written down, and how quickly you'd tell the client about a breach.
• Whether you carry cyber insurance.

Several of these overlap with cyber insurance forms. If you've answered one of those, start there: see what your cyber insurance application wants you to have.

What a partial answer looks like

A partial answer says what's in place, what isn't, what you're doing about it in the meantime, and when it will be finished. For example: "Multi-factor sign-in is required on all staff accounts. One older account used by an outside bookkeeper doesn't have it yet. Until then it has no administrator rights and we review its sign-ins weekly. We'll finish by [date, year]."

Describe the gap in general terms. Don't name accounts, people, or systems.

That gives the client something accurate to work with. A plain "yes" that turns out to be wrong can come up later, when the client checks or the contract renews, and it's harder to explain then.

Leave nothing blank. If a question doesn't apply, say why in one line, for example "Not applicable: we don't store card numbers."

What counts as proof

Proof is anything that shows the answer is true today. Good proof is dated and specific:

• A dated screenshot or export that shows who or what the setting covers, not just that the setting exists. For example, a report listing every account and whether it uses multi-factor sign-in.
• A short written policy, even one page, for things like removing access when someone leaves.
• Training completion records.
• A dated record of a restore: what you restored, from which backup, who did it, and whether it worked.

Some questionnaires first ask for an independent audit report or certification. If you don't have one, say no. A self-assessment or checklist you completed yourself is your own statement, not a certification, so describe it that way and date it.

Ask the client which of these they want. Some want a summary; some want screenshots. Don't send more than they ask for. Hide account names, addresses and network details in screenshots, and send proof through the client's portal or a secure link, not as plain email attachments.

Who answers, and who signs

Your business does. An IT provider can tell you what's set up for the tools it manages for you, and that's a big part of the answers. It can't answer for your own practices, such as how you handle client files or who you give access to, and it doesn't sign for you.

If the questionnaire is part of a contract, have whoever reviews your contracts read it before you sign. This isn't legal advice.

When you can't say yes yet

Say so, and say when. "Not yet; planned by [date]" is a complete answer. Then do the work in the order the client cares about most, which you can usually tell from the questions they asked first or marked required.