Client Security Questionnaires: How Professional Services Firms Pass Them

Answer from controls you can prove, like enforced MFA, encrypted laptops with EDR, tested backups, and a written incident plan. Mark anything partial honestly and give a date for the fix.

The questionnaire usually comes with a renewal. Somebody in the client's procurement group emails an Excel file, or a login to a vendor portal like OneTrust or Whistic, and it has anywhere from 80 to 400 rows and a two-week deadline. For plenty of law firms, CPA practices, and consulting groups, that's the first time anyone has had to write down how the firm's IT works. Our page on IT services for professional services firms covers what that setup should include.

Key Takeaways

Clients send these because you hold their files and talk to their staff every day. SIG Lite, the CAIQ, and homemade spreadsheets ask about the same things, mainly logins, laptops, data, training, and incident response. Name the control, say how it's enforced, and attach the evidence. If it's partial, say so and give a date. Your IT provider can answer the technical rows. The policy rows are the firm's.

Why do clients send professional services firms security questionnaires?

Because your firm holds their contracts, tax returns, or strategy documents, which makes it part of their attack surface. NIST tells organizations to rank suppliers by the sensitivity of the data they hold and their access, and firms rank high on both.

The NIST document is SP 1305, a quick-start guide to supply chain risk management under CSF 2.0. It says to set supplier criticality by "the sensitivity of data processed or stored by the supplier, and degree of access to the organization's systems." Think about outside counsel on an acquisition. They hold the draft purchase agreement and the target's financials in NetDocuments, and their associates email the client's general counsel all day, so under that test they're near the top of the supplier list.

IBM's Cost of a Data Breach Report 2026 has supply chain compromise as the second most common way in, after phishing. A business partner compromise was the factor that added the most to breach costs, about $227,250. IBM's services category, which is legal, accounting, and consulting firms, averaged $5.08 million per breach.

Law firms got these first. In 2020 the New York State Bar Association described questionnaires "often running to 90 pages or more" and quoted small-firm leaders saying "Now they want screenshots." Six years on, the screenshots are still being requested.

What do client security questionnaires actually ask?

They ask about sign-in, laptops and phones, where client files are kept and backed up, staff training, and the incident response plan. Length varies a lot. A two-page addendum from a client's legal team and a SIG Core from its vendor risk group ask about the same things.

You can read the CAIQ before yours arrives, since the Cloud Security Alliance publishes it free. A lot of it is about data centers and hypervisors, which won't apply to a 30-person firm.

On almost every questionnaire I've reviewed, the rows below come up in some form, so they're worth preparing first.

EDR, or endpoint detection and response, is software on each laptop that looks for attacker behavior (our explainer on what EDR is compares it to antivirus). A penetration test means paying a specialist to try to break in. A vulnerability scan is an automated check for known holes, explained in the pen test vs scan difference, and a scan report sent for the pen test row usually gets sent back.

Where do firms usually fail these questionnaires?

Firms rarely fail because a control is missing outright. They fail because an answer claims more than the environment does, such as MFA that skips one shared mailbox, backups that have never been restored, or an incident plan that still names someone who left in 2024.

A typical example is an MFA exception made for a partner whose authenticator app stopped working the night before a trial, which was meant to last a week and is still in place two years later. Another is a backup migration in 2023 where the old service kept running alongside the new one, so the firm now pays for both and can't say which one holds the client files from before the move.

MFA is where the gap between yes and yes-done-properly is widest. CISA's fact sheet on phishing-resistant MFA says "any form of MFA is better than no MFA," then explains how text-message codes can be intercepted and how plain push approvals get worn down by repeated prompts (push bombing). For businesses that can't move to phishing-resistant methods yet, CISA names app-based codes or push with number matching as the best options. A reviewer who reads MFA via SMS will usually send a follow-up question rather than fail the firm outright.

How should you answer when a control is only partly in place?

Say it's partial, describe what covers the gap today, and give a date for the fix. Reviewers can work with an honest partial answer, but a yes that later proves false becomes a problem in its own right.

Here's what that looks like in a row. Partial. MFA is enforced for all users except two service accounts, which are restricted to the office network. Removal of the exception is scheduled for January 2027.

If your answers end up attached to an engagement letter or a security addendum, they stop being a description and become a commitment, and after an incident someone will compare that commitment to the logs. Picture a firm that answered all laptops are encrypted when three older machines weren't. If one of those laptops is left in a rideshare, the questionnaire is now evidence against the firm.

Should your firm get a SOC 2 report instead?

A SOC 2 report can replace much of a questionnaire for clients who accept it, though rarely all of it, and it takes months and an audit fee. It makes sense when clients keep asking for it by name, and much less sense for a firm that gets two questionnaires a year.

SOC 2 is an independent auditor's report on your controls, and the Type I vs Type II difference matters to clients. Type I says the controls existed on one date, while Type II says they operated over a period, usually 6 to 12 months, and clients who ask for SOC 2 almost always mean Type II.

Even with a report, expect a shorter questionnaire, since clients still ask about things outside its scope (your insurance, your subcontractors, how you'll handle their particular data). A 15-person consultancy with three enterprise clients and one questionnaire a year should skip SOC 2 for now and spend the effort on a clean answer library. Once questionnaires cost a partner several days a quarter, or a prospect makes SOC 2 a contract condition, our SOC 2 compliance services page lays out what readiness involves.

Which answers belong to your firm, and which to your IT provider?

Your IT provider can answer how systems are configured and monitored, and attach the evidence. Your firm has to answer for its policies, people, contracts, and insurance. A questionnaire mixes both, often within the same section.

Law firms have an ethics layer on the vendor rows. ABA Formal Opinion 477R says a lawyer "must exercise reasonable efforts when using technology in communicating about client matters," and it lists vendor checks such as "reference checks and vendor credentials" and the "vendor's security policies and protocols," so a client asking about your vendors is really asking whether you did that diligence. For tax practices, IRS Publication 5708 says of the written information security plan (WISP) that "the law requires you to have one," and the FTC's Safeguards Rule guidance describes what the plan has to cover.

Compliance work is separate from day-to-day IT. Building a formal program or preparing for a SOC 2 audit is its own engagement through compliance services, and a managed IT contract doesn't include it by default. A managed IT provider should still be able to hand you the configuration evidence for the technical rows within a day or two, and if yours can't, it's worth asking how well they know your environment.

A partner at a business consulting firm in Irvine, which has worked with Consilien since 2018 and reported 100% uptime through its hardware conversions, wrote on Clutch, "I'm impressed by their very smart executives and high-end IT knowledge." That kind of knowledge of the environment is what a questionnaire draws on.

How do you build an answer library you can reuse?

Keep one document with an approved answer for every recurring question, an owner for each answer, the evidence file it points to, and a review date. Update it when the environment changes, not when the next questionnaire arrives.

The first questionnaire is the slow one, because the firm is documenting its environment while answering. After that, most of the work is confirming that last quarter's answers are still true.

• Week 1. Collect the last two or three questionnaires you received and copy every question into one sheet, then merge the duplicates. The list gets much shorter than the page counts suggested.
• Week 2. Ask your IT provider for the evidence on the technical rows (the MFA policy, EDR coverage, encryption report, last backup restore). Any row they can't evidence goes on a fix list.
• Week 3 is the firm side, meaning policies, the incident response plan, and insurance details. If there's no written plan yet, start with our piece on why you need an incident response plan.
• Week 4. Have one partner read every answer against reality, then set a review date six months out.

Your cyber insurance renewal will ask a lot of the same things (MFA, backups, EDR, training), so the library does double duty, and our 2026 cyber insurance requirements checklist lists what carriers check. Pricing this level of support is covered in the managed IT cost guide for professional services firms, security add-ons included.

With a questionnaire already on your desk and the deadline close, speak to a professional services IT expert about which rows your current setup can already prove.