A corporate client sends a 150-question security questionnaire and wants it back in two weeks. Someone at the firm, usually the administrator or a partner who drew the short straw, starts typing "yes" into boxes. Months later, nobody remembers what was promised, and the answers do not match reality.
Client security questionnaires, along with outside counsel guidelines, are now a normal cost of doing business for firms that serve banks, insurers, healthcare organizations, energy companies and other regulated clients. Handled well, they can become a competitive advantage. Handled badly, they create contractual risk.
Why Accuracy Matters More Than Speed
A questionnaire response often becomes part of the client relationship. If you attest to a control that is not in place, such as MFA on all accounts or encryption on all laptops, and an incident follows, the gap between your answer and the facts can become a dispute. Answer what is true today, describe partial controls honestly, and note planned improvements with realistic dates.
Build an Answer Library
Most questionnaires ask the same things in different words. A reusable library saves hours.
- Collect the facts once. Document your controls in a short internal reference: MFA, encryption, endpoint protection, patching, backups, access management, logging, incident response, training and vendor management.
- Write standard answers to common questions in clear sentences. Tag them by topic.
- Record evidence for each answer, such as a policy document, a screenshot or a report, and where it is stored.
- Assign an owner who reviews the library twice a year and after major changes.
- Track each completed questionnaire, noting which client it was for and what you committed to.
The Typical Topics
Governance
Do you have a written information security policy, a named person responsible for security, risk assessments and periodic reviews?
Access control
How do you manage accounts, MFA, privileged access, offboarding and remote access?
Data protection
Is data encrypted at rest and in transit? Where does it live, and how is it classified, retained and disposed of?
Technical safeguards
Endpoint protection, email security, patching timelines, network protections, vulnerability scanning, logging and monitoring.
Resilience
Backups, disaster recovery, testing frequency and recovery objectives.
People
Background checks, security awareness training, confidentiality agreements and policy acknowledgments.
Incident response and vendors
A documented plan, notification commitments and how you evaluate subcontractors who touch client data.
Handling Tough Questions
- When you do not meet the requirement, say so and describe compensating controls or a remediation plan. Many clients value candor over perfection.
- When the question is ambiguous, ask for clarification instead of guessing.
- When asked for a certification you do not hold, such as SOC 2 or ISO 27001, state that you do not hold it and describe what you do have. Do not imply equivalence.
- When a client asks for access to your systems or on-site audits, involve your IT provider and a partner before agreeing.
- When contract terms appear, such as notification timelines or liability, have counsel review them. A questionnaire is not the place to accept legal obligations casually.
Process for Each Request
- Log the request and deadline.
- Assign one coordinator.
- Pull answers from the library and flag gaps.
- Route technical questions to your IT provider for confirmation.
- Have a partner review and approve before sending.
- Save the final version and any commitments in the client file.
- Add new answers to the library.
Use Questionnaires as a Roadmap
Patterns across requests tell you what clients care about. If several ask about MFA, endpoint monitoring or incident response testing, make improvement projects out of them. Closing a gap once is cheaper than explaining it repeatedly.
Ethics Connection
Rule 1.6(c) asks lawyers to make reasonable efforts to prevent unauthorized disclosure of client information, and many clients use questionnaires to confirm that. Honest, documented answers help you show your efforts.
Help With the Heavy Lifting
Counsel Cyber helps law firms assemble answer libraries, verify technical responses and close gaps that clients keep raising. If you have a questionnaire in front of you now, we can help you review it.