Why you're getting these
Larger clients, especially in finance, healthcare and regulated industries, are expected to check the security of the firms they share data with. Your CPA, law or advisory firm is one of those vendors. The questionnaire is how they document that review.
How to answer well
- Ask what applies. If you don't host software or process card payments, some sections may not apply. Ask, and mark N/A with a reason.
- Ask for a realistic deadline if the one given isn't workable.
- Answer for what's true today, not what's planned or what you think the client wants to hear.
- Tie each "yes" to evidence: a policy, a setting, a report or a log. Know where it is in case they ask. See what IT evidence your firm can provide.
- Explain any "no" briefly. Describe what you do instead and, if you're working on it, a target date.
- Have someone review it before it goes out, ideally an owner and your IT provider.
Questions that commonly trip up small firms
- "Do you have a written information security policy?" If it doesn't exist, a "yes" is risky. A WISP may also be required for tax firms.
- "Do you require MFA for all users?" Check for exceptions, such as shared accounts or a legacy app.
- "Do you test backups?" "We have backups" isn't the same answer. See does your backup actually restore files?
- "Do you have an incident response plan?"
- "Do you have a SOC 2 report?" Most small professional firms don't, and many clients accept other evidence for a firm your size. Ask what they'll accept instead.
- "Do you assess your own vendors?" That includes your IT provider. See MSP certifications, audits and references.
Make the next one faster
Keep a simple answer library: common questions, your current answers, who owns each one, where the evidence is and when it was last reviewed. Update it when something changes, like a new MFA rollout or a new backup system. Many firms find the second and third questionnaires go much faster once the first one is done carefully.
If you're a Blue Tree Technology® client
Call us when a questionnaire arrives. We always encourage our clients to reach out. Our goal is to give you the information you need about your own environment so you can answer each question accurately, to the best of your knowledge. The answers stay yours, and you review and submit them.
FAQ
Can we just say "yes" to everything to keep the client?
That's risky. Inaccurate answers can become a contract or liability issue if there's ever an incident. An honest "partially, here's our plan" is usually better received than you'd expect.
Do we need SOC 2 to keep working with larger clients?
Not necessarily. It depends on the client and the work. See HIPAA, PCI DSS, SOC 2 and the FTC Safeguards Rule are not the same thing.
Should our IT provider fill it out for us?
They should help with the technical answers, but the firm owns the submission and should review it.
Still have a question?
Ask Little Sprout for general information. If a questionnaire is sitting in your inbox, schedule a free 15-minute discovery call and we'll talk through it.