The email arrives on a Tuesday afternoon. A client — a good one, the kind you do not want to lose — has attached a security questionnaire. They need it back within the week. Someone forwards it to the IT provider. The answers that come back are partial, hedged, or written in language nobody in the firm can confidently sign off on.
That experience is becoming common. Larger clients, regulated industries, and public sector procurement processes now routinely ask suppliers to demonstrate security standards before or during a contract.
For many professional services firms, completing one of these questionnaires is the first time they have had to put their security posture in writing. The experience is often uncomfortable — not because the firm is insecure, but because nobody has ever had to articulate what is actually in place.
The questionnaire did not create the problem. It just made it visible.
What Client Security Questionnaires Are Really Asking
Most security questionnaires follow a similar pattern. They ask about multi-factor authentication, endpoint protection, data encryption, backup testing, access controls, and incident response. The language varies. Some are technical. Some are plain English. Some use frameworks like Cyber Essentials or ISO 27001. But the underlying question is the same: can we trust this firm with our data?
That is a business question, not a technical one. The client is not asking for a detailed IT audit. They are asking whether your firm takes client data seriously enough to have basic controls in place, clear ownership of those controls, and some way of proving it. They want specific and confident answers, not reassuring and vague ones.
When a firm struggles to answer, it is rarely because the controls do not exist. More often, nobody has a clear view of what is in place, who owns it, and where the evidence sits. The firm’s IT provider may have implemented strong controls. The firm may not be able to describe them. That gap is what the questionnaire exposes.
Why Firms Struggle to Answer Security Questionnaires
The most common reason firms struggle is visibility. Controls may be in place but undocumented. The IT provider configured multi-factor authentication eighteen months ago — but is it applied to every user, every device, and every application? The firm cannot say with certainty because nobody has checked recently and the provider’s last report is buried in an inbox somewhere.
Ownership is the second issue. When a questionnaire asks who is responsible for reviewing access rights, or who would lead the response to a data breach, the honest answer in many firms is that it depends. Depends on who is available. Depends on whether the IT provider is reachable. Depends on whether the incident is serious enough to escalate.
That kind of answer does not belong on a supplier questionnaire. But it reflects reality in firms where accountability has never been written down.
The third issue is evidence. Saying a control exists is one thing. Showing an audit log, a backup report, or a configuration record that proves it is another. Firms that have not been asked this question before are often surprised to discover that the evidence trail is thinner than they assumed. Not because the controls failed, but because nobody was keeping records with this question in mind.
What Good Security Questionnaire Readiness Looks Like
A firm that handles security questionnaires well is not necessarily doing more than other firms. It has clarity that other firms lack. The controls in place are documented. Ownership is assigned. Evidence is maintained as a matter of routine rather than assembled in a hurry when someone asks.
In practice, that means the firm knows what its IT provider is responsible for and what the firm owns directly. It knows which controls apply to which systems and users. It has a provider who communicates in plain English rather than leaving the firm to interpret technical reports.
When a questionnaire arrives, the firm can ask its provider a short list of specific questions and get specific answers back. That works because both sides have kept the picture current.
It also means the firm has something to show. Backup test records. Access review logs. An MFA enrolment report. Not a pile of technical documentation — just enough evidence to stand behind the answers being given. That evidence exists in well-run IT environments as a byproduct of normal operation. The only question is whether the firm knows where it is.
A client security questionnaire is not a threat. It is useful intelligence. It shows exactly where the gaps are before a client, an insurer, or a regulator finds them first. The firms that treat it that way come out of the process stronger. The firms that treat it as a paperwork exercise to be got through come back to it again, next time under more pressure.
Not sure how your firm would perform against a client security questionnaire?
The IT Ownership Scorecard takes 5 minutes
