Situations
You have received a third-party cybersecurity assessment
A customer sent a security questionnaire with a deadline. Here's what to do before you answer.
The short answer
What this really means.
Your answers become promises to your customer. Only say what's actually true, and have proof behind it.
Start here
What to do first.
-
Find out what's being asked
Which systems, which data, and by when.
-
Pick one owner
One person signs off on every answer.
-
Check what's true
Answer from how your systems really work, not from memory.
-
Be honest about gaps
A clear "not yet, here's our plan" beats a wrong "yes."
Watch out
Where people go wrong.
-
Copying old answers
Last year's answers may not be true today.
-
Guessing for your IT company
If your provider runs it, they need to confirm it.
-
Saying yes to everything
A wrong yes can come back as a broken contract.
How we help
You don't have to do this alone.
We review the questions, check each answer against your systems, and build a set you can reuse for every customer.
Services that help
What this usually calls for.
-
Vendor and Third-Party Oversight
Your vendors handle your data and your systems. We make sure they do what they promised.
-
Security Program Assessment
A report card on your security: what's strong, what's weak, and what to fix first.
-
Regulatory and Framework Readiness
Get ready for the security rules that apply to you, and stay ready between audits.
Questions
Common follow-up questions.
Who should sign off on the answers we return?
One senior person who can confirm the answers are true. Not whoever happens to be free.
Can we answer no to a question without losing the deal?
Usually, yes. An honest no with a plan and a date is better than a yes you can't back up.
The assessment asks about controls our provider operates. Who answers those?
Your provider confirms them, and you check their proof. The answer is still yours.
Do we need a SOC 2 report to satisfy this?
Not always. Many customers accept honest answers with proof. Some larger ones will ask for SOC 2.
Insights
Related reading.
-
Compliance and Audit Readiness
When SaaS Vendors Must Be Treated as Subservice Organizations Under SOC 2
SaaS companies undergoing SOC 2 audits face a critical question: when does a vendor's security become part of your own compliance obligation? This article explains the subservice organization concept, when vendors must be included in your SOC 2 scope, what evidence auditors require, and who inside your organization is accountable for the outcome.
Dr. Daniel Glauber, 20 August 2026
-
Governance
Vendor, MSP and Third-Party Oversight: What Leadership Must Decide
Vendor and third-party oversight is now a regulatory and operational requirement that leaves executives accountable for outcomes they cannot see clearly. This article explains what the obligation entails, who should own it, and how to establish effective governance without replacing existing technical controls.
Dr. Daniel Glauber, 11 August 2026