What That Security Questionnaire From Your Biggest Client Really Asks

Your customer isn't curious about your firewall brand. They're trying to answer one question for their own board and their own cyber insurer: if this vendor gets breached, does that breach become our problem? Credential abuse shows up at some point in 39% of breaches according to the Verizon 2026 DBIR, and a huge share of those incidents start with a trusted third party — a vendor, a contractor, a supply-chain partner. Your customer's security team has read that data. The questionnaire is their attempt to push that risk back onto you before it becomes their incident.

That reframes everything. You're not filling out a form to make compliance happy. You're convincing a counterparty that doing business with you won't blow up their own risk posture.

"Describe your access control policy"

They want to know if a terminated employee still has a login six months later, and whether anyone besides IT has standing admin rights they don't need day-to-day. This is where privileged access management comes up — not as a buzzword, but as the actual control they're probing for. If you can say logins are reviewed on a schedule, admin rights are limited to the people who need them, and offboarding kills access same-day, you're answering the real question, not the literal one.

"Do you enforce multi-factor authentication?"

They're asking whether a stolen password alone can get into your environment. "Yes, on email and VPN" is a much weaker answer than "yes, on every remote access point and privileged account." Be specific about scope — reviewers can tell when an answer is vague on purpose.

"What is your incident response plan?"

This one is a trap for most small and mid-size businesses, because the honest answer is often "we don't have one written down, we'd just call our IT provider." That's not disqualifying by itself, but it needs to be formalized before you submit. A one-page plan naming who gets called, what gets isolated, and how customers get notified is enough to pass most reviews — and it's something your managed IT provider should already have drafted with you.

"How do you handle subcontractors and fourth parties?"

They're asking if your risk is actually your risk, or if it's really three vendors deep and invisible to you. If you outsource payroll, cloud hosting, or IT support, you need to know and be able to state what those vendors do for security. This is exactly the chain-of-custody thinking behind frameworks like the FTC Safeguards Rule and HIPAA business associate requirements — if you've never mapped your own vendor dependencies, this is the moment to do it.

"Describe your data encryption practices"

In plain terms: if someone steals a laptop or a backup drive, is the data on it useless to them? Encryption at rest and in transit is close to table stakes now. If you're still running unencrypted file shares or backups, that's a gap worth closing before the next questionnaire, not during it.

The most common mistake isn't a missing control — it's an answer that oversells what you actually do. Questionnaire reviewers cross-reference answers against your website, your SOC 2 report if you have one, and sometimes a follow-up call. Claiming "continuous monitoring of all endpoints" when you mean "our antivirus runs scans" gets caught, and it torches trust faster than admitting a gap with a remediation date attached.

The second mistake is treating this as a one-time fire drill. Enterprise customers reissue these annually, sometimes with tighter requirements each cycle. If you scrambled this year, budget time next year to actually close the gaps the questionnaire surfaced — don't just survive it again.

If your business has 20 to 99 employees, there's a direct legal upside to doing this work properly. Texas SB 2610, effective September 1, 2025, shields a business from exemplary damages in a data breach lawsuit if it has implemented the CIS Controls Implementation Group 1 safeguards — 56 specific controls — before the incident. It doesn't create a new lawsuit risk and it doesn't guarantee you avoid litigation, but it changes the damages math if you're ever sued over a breach. Source: Texas SB 2610 (as of 2026-08-20). The overlap between IG1 controls and what a customer questionnaire asks for is substantial — MFA, access reviews, asset inventory, logging. Doing the work once covers both.

Businesses sometimes treat the questionnaire as busywork and answer it loosely to get the contract signed faster. That's a bad trade. If a breach happens and the customer's security team pulls up your questionnaire answers, any daylight between what you claimed and what you actually had in place becomes a contract and liability problem on top of the breach itself. The median cost to recover from a ransomware incident, not counting any ransom paid, runs $375,000 according to Sophos State of Ransomware 2026 (as of 2026-08-20) — and that's before a customer terminates the relationship over a questionnaire that turned out to be fiction.

Most of these questionnaires map cleanly to a handful of core services: documented cybersecurity practices, structured managed IT oversight, and clean Microsoft 365 configuration if that's your email and file platform. If you're switching providers because your current one can't produce these answers on request, our guide to switching IT providers walks through how to do that without disrupting operations. Businesses around The Woodlands and across the Houston corridor are seeing these questionnaires more often as regional manufacturers and suppliers get pulled into larger supply chains — this isn't a one-off anymore.

How long does it usually take to answer one of these questionnaires properly?

For a business with no documented security program, expect one to three weeks of real work — not filling out the form, but actually verifying the answers are true. Once you have a baseline, future questionnaires take a day or two.

Do we need a SOC 2 report to pass these?

Not always. Many mid-market customers accept a completed questionnaire plus evidence (policies, screenshots, a vendor risk summary) without a formal audit. Larger enterprise and regulated customers increasingly expect SOC 2 or an equivalent. Ask early which tier your customer falls into.

What if we genuinely don't have some of the controls they're asking about?

Say so, and give a remediation timeline. Most procurement teams would rather see an honest gap with a plan than a vague answer that sounds complete but can't be verified.

If a customer questionnaire just landed on your desk and you're not sure how your current setup stacks up, get a free IT assessment or talk to us directly — we'll help you answer it accurately the first time.