← All Blogs

When your customer sends you a security questionnaire

By Best IT MSP Editorial Team - Updated October 21, 2026 - 10 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

What should you do when a customer sends you a security questionnaire?

Sort the questions into four buckets before you answer a single one. Some questions only your business can answer. Some belong to your IT provider. Some are already answered by a document you hold. The rest are honest nos that need a compensating control and a date.

Your customer is not being difficult. Large buyers now run formal third-party risk programs, because the data gives them no choice. Verizon found a third party involved in 48 percent of all breaches, and that third-party supply chain breaches jumped 60 percent year over year. IBM puts the global average cost of a data breach at $4.99 million. The file on your desk is one page of someone else's vendor risk management program, and it arrived because your customer is now accountable for you.

One rule governs everything below. A questionnaire answer is a contractual representation about how your business operates, not paperwork. A yes you cannot evidence is a false statement sitting in your customer's file, and it surfaces during an incident, which is the worst moment available.

This guide covers the inbound questionnaire only. It does not re-cover the frameworks. Read Is SOC 2 a certification? What to ask for instead for what an attestation actually is, SOC 2 homework: complementary user entity controls for what your provider's report leaves to you, and Audit evidence: the 7 records nobody collects for the records an auditor asks to see.

Sort every question into four buckets

To sort a security questionnaire, read every question once and mark it with one of four labels. Answer nothing on the first pass. The sort is the work, and the answers are the easy part once the sort is done.

• Yours. The question asks about a business decision, so only you can answer it. Who approves a new user. Who signs off on a new vendor.
• Theirs. The question asks about a technical control your IT provider operates, such as patching, endpoint detection, backups, or multi-factor authentication.
• Filed. The question is already answered by a document you hold, such as a SOC 2 report, an insurance certificate, a written access control policy, or a network diagram.
• No. You do not operate the control. This bucket gets a compensating control, a named owner, and a date, never a creative yes.

The sort takes about two hours and it is the highest-value work in the exercise. Most businesses skip it. They forward the whole file to their IT provider and ask them to fill it in. That is how a false answer gets signed, because your provider has no visibility into your hiring, your contracts, or the places your customer's data actually sits.

Scope the questionnaire before you answer it, if the customer has not scoped it for you. Ask which systems and which data the assessment covers. A question about cardholder data does not apply to a business that never touches a card number, and not applicable with one line of reasoning is a legitimate answer. A guess is not.

Which questions must you answer yourself?

You must answer every question about a business process yourself, because no vendor can observe your decisions. Three of them appear on almost every questionnaire, and all three are named controls in a public standard.

CISA's Cybersecurity Performance Goals name them outright. Goal 2.A asks for an asset inventory covering data, hardware, software, systems, facilities, and personnel. Goal 3.D asks you to prevent unauthorized access by former staff, and to disable accounts that stay inactive, which in practice means a quarterly access review. Goal 3.J asks for at least annual cybersecurity training, with new hires trained before they get access.

Your IT provider can disable an account. Only you know that someone left on Friday. That gap is not academic. IBM found it takes an average of 247 days to identify and contain an active breach, and a live account belonging to someone who left last year is exactly the kind of door that stays open that long.

Five questions sit in the Yours bucket on nearly every assessment.

• Who approves a new employee's access, and who removes it on their last day.
• Which of your staff handle customer data, and what training each one completed.
• Where your customer's data is stored, and which other vendors can see it.
• Who owns security decisions in your business, by name and job title.
• What happens when a customer reports a problem, and how fast you escalate it.

Answer these in your own words, then keep the answers. They do not change much between questionnaires, which is the start of a reusable answer file.

Which questions does your MSP genuinely own?

Your MSP owns every question about a technical control it operates inside your environment. Send that bucket over with a deadline, and give one instruction. Ask for the number, not the yes.

A yes to do you patch systems promptly means nothing. A patch compliance figure for last month means something. Verizon measured a median 43 days to fully remediate a critical vulnerability on CISA's known exploited list, and found only 26 percent of them fully remediated at all. Almost every organization in that dataset would have answered yes.

Five answers come back as figures, so ask for them that way.

• Patching cadence, with last month's compliance percentage and the machines that failed.
• Endpoint detection coverage, with the count of devices not reporting in.
• Multi-factor authentication enforcement, with the list of accounts still exempt.
• Backup testing, with the date and duration of the last restore.
• Log retention, with the number of months your provider can search today.

Record control ownership while you are in there. For each control, write down who operates it, who evidences it, and who answers for it. Shared responsibility is a split of accountability, not a split of effort, and it has to be explicit before a customer asks. CISA goal 3.O asks for backup and recovery testing no less than once per year, and goal 3.F asks for multi-factor authentication using the strongest available method. Both are your provider's answers to supply and your answers to verify, because an independent check is what separates a control someone operates from a control someone bought. Our MSP cybersecurity checklist covers what belongs in the base fee.

Which questions can you answer by pointing at a document?

You can answer a large share of questions by attaching a document you already hold, so assemble the file before you type anything. A SOC 2 report, a signed business associate agreement, a cyber insurance certificate, a written access control policy, and a network diagram between them cover dozens of questions on every questionnaire you will ever receive.

One artifact source is free, public, and almost nobody uses it. The Cloud Security Alliance runs STAR, a publicly accessible registry documenting the security and privacy controls of cloud offerings, and a Level 1 listing is a complimentary self-assessment built from the CAIQ questionnaire. So when the assessment asks which subprocessors hold your customer's data and how those vendors are controlled, you can look your cloud providers up in a public registry and cite their published answers. No emails to a sales team, no waiting a week.

The questions also repeat, which is the second reason the file pays off. The CAIQ sits on the Cloud Controls Matrix, which carries 197 control objectives structured in 17 domains. Most questionnaires are reworded from a small set of published standards, including the CAIQ, the SIG from Shared Assessments, and NIST's cybersecurity supply chain risk management guidance. Nothing on the page in front of you is arbitrary, and the second questionnaire takes a quarter of the time.

Regulated data brings its own paperwork, and the flow-down language is the part to read. Under the HIPAA rules, a business associate must ensure that subcontractors handling protected health information agree to the same restrictions and conditions that apply to the business associate. The same rule authorizes your customer to terminate the contract if you violate a material term. Your answers are attached to that right.

How do you answer no without losing the account?

To answer no without losing the account, put four things in the box. The word no, the compensating control you run instead, a named owner, and the date you will close the gap. That is not a softened no. It is the answer a competent vendor risk management reviewer is hoping for.

The term is not improvised. NIST defines a compensating security control as one employed in lieu of a recommended baseline control, providing comparable protection for the system. Your reviewer knows the phrase. Using it correctly tells them you understand control ownership instead of dodging a question.

Here is one in full. The question asks whether you run a 24/7 security operations center. You do not. The honest answer reads as follows. No. Our managed provider runs endpoint detection with alerts to an on-call engineer, with a one-hour target response outside business hours. We are quoting a monitored service and will decide by March 31. Four lines, one specific date, nothing invented.

Compare that with a yes. A yes puts a document in your customer's file stating you operate a control you do not operate. If a breach follows, that document is the first thing their lawyers read. Regulators already treat security claims as claims. The FTC brought an action alleging a hosting company misled customers about the extent of its data security protections. You are smaller than that company. The principle does not scale down.

Pick a date you can actually hit, because the date carries legal weight of its own. Verizon's survival analysis of third-party cloud multi-factor authentication exposures found 58 percent still unresolved after seven days and 42 percent still unresolved after 90, so remediation dates slip as a rule. Penn State paid $1,250,000 to resolve False Claims Act allegations across fifteen federal contracts or subcontracts, and the allegation was not that it hid the gaps. The Justice Department said it submitted assessment scores reflecting that it had not implemented certain controls, but misrepresented the dates by which it would implement them and did not pursue plans of action to do so. An honest no with a date nobody works toward is still a misrepresentation, so add half again to your honest estimate, write down the slower date, and put the work in someone's calendar.

A no with a date is a negotiation. A yes you cannot evidence is a liability you signed.

What to do in the ten days before it is due

To finish on time, work the questionnaire in five passes instead of answering it from the top.

• Scope it first. Ask the customer which systems and which data the assessment covers, and whether every question is mandatory. Get the reply in writing.
• Triage the file. Mark each question Yours, Theirs, Filed, or No. Two hours, one person, no answers yet.
• Delegate the Theirs bucket. Send it to your provider with a deadline three days before yours, and ask for figures rather than confirmations.
• Pull the Filed bucket. Collect the documents into one folder, and note the exact page each answer comes from.
• Write the Nos last. Give each one a compensating control, an owner, and a date, then review them together before you submit.

Name one accountable owner for the whole file, with the authority to commit to a date. Then turn the exercise around. CISA goal 1.E asks organizations to identify, record and assess the risks posed by a managed service provider, and goal 1.D covers supply chain incident reporting, using contracts and service level agreements to require vendors to report incidents on a timeframe you set. Your customer is doing that to you this week. Doing it to your own providers is how next year's questionnaire takes two days instead of ten.

What to ask your IT provider this week

Ask five questions, and write the answers down in the order they arrive.

• Which questions on this questionnaire can you answer with a number, and which with a document?
• What was our patch compliance percentage last month, and which machines failed?
• When did you last restore our data in a test, and how long did it take?
• Which accounts in our environment are exempt from multi-factor authentication today?
• How many months of logs can you search right now, without restoring anything?

A provider who answers all five inside a day is a provider you can hand the Theirs bucket to. A provider who sends a product list will leave you to guess, and guessing is the one thing you cannot afford on a document your customer keeps on file. None of this buys perfect security, and no honest answer claims it does. It buys a verifiable file, a dated remediation plan, and a customer who trusts your paperwork because your paperwork turned out to be true.

FAQ

Can my IT provider fill out a security questionnaire for me?

No, not the whole thing. Your provider can answer the technical questions it operates, such as patching and backups. Only your business can answer who approves access, who handles customer data, and who removes an account on someone's last day. CISA goal 2.A asks for an asset inventory covering data, hardware, software, systems, facilities, and personnel, which is yours.

What happens if I answer no on a security questionnaire?

A no rarely loses the account, and an unsupported yes often does. Write the no, the compensating control you run instead, a named owner, and a date. NIST defines a compensating security control as one employed in lieu of a recommended baseline control, providing comparable protection, so the term is one your reviewer already uses.

Is a SOC 2 report enough to answer a customer security questionnaire?

No. A SOC 2 report answers a subset of questions and leaves the rest to you, because it covers only the controls inside its own scope and observation period. Customer questionnaires draw on wider standards such as the CAIQ, which sits on a matrix of 197 control objectives across 17 domains. Attach the report where it applies, then answer the business questions yourself.

Do I have to answer every question on a vendor security questionnaire?

No. Ask your customer which questions are mandatory and which are informational, and get the reply in writing. Where a question covers data you never handle, answer not applicable and give one line of reasoning. A guess is the answer that creates risk, because 48 percent of breaches now involve a third party and your file gets read.

How long should I give my IT provider to answer their part?

Set their deadline three days before yours, and ask for figures rather than yes answers. Verizon measured a median 43 days to fully remediate a critical known exploited vulnerability, so a provider who replies that it patches promptly has told you nothing. Request last month's patch compliance percentage and the machines that failed.

← All Blogs