From Intarmour ARC:New research on cyber risk in M&A
Book a consultation

Diagnostic tool

Are you ready for your client’s security questionnaire?

Twenty controls covering confidentiality, access, updates, backups and suppliers. The result shows whether you can answer today and what to fix first.

21 questions Computed in your browser

Who it’s for

Who it’s for

Owners, management and IT leads of companies and professional firms that have received, or expect, a security questionnaire from a client.

How it works

Say who sends you questionnaires, then answer the 20 questions. The index, the outcome and the number of blocking points appear straight away; the list of gaps, with what to do about each, follows once you leave your email.

What it can indicate

  • Whether you can answer today without declaring controls that are not in place.
  • Which minimum requirements are missing: one or more of them means a “Not ready” outcome.
  • What to do about each gap, starting with the blocking ones.

What it cannot do

  • It is not a certification or a check of your systems.
  • It does not predict how a questionnaire will be judged: each client applies its own criteria.

The questions

Answer for your situation today. If you are unsure, choose “Not sure”: a questionnaire cannot declare what you do not know, so it counts as “No”.

Your clients

1Who sends you security questionnaires?

Minimum requirements

A “No” or “Not sure” on any of these questions makes the outcome “Not ready”.

2Have all employees and contractors who see client data signed a confidentiality undertaking?

3When someone leaves the company, are their accounts closed within 24 hours?

4Is two-factor authentication mandatory on email, cloud services, remote access and admin accounts?

5Is remote access only through a VPN or an equivalent system with MFA, with no remote desktop exposed to the internet?

6Is client data always encrypted in transit (TLS 1.2 or later), file exchanges included?

7Are critical security updates installed within 14 days?

8Is every system used for work still supported (for example, no Windows 10 without updates)?

9Could you notify a client of an incident affecting them within 24 hours?

10Are there regular backups with at least one offline or immutable copy?

11Can you tell clients which suppliers have access to their data?

Other controls

12Is there a written security policy, approved by management and reviewed in the last year?

13Are security risks assessed at least once a year?

14Do staff receive security training at least once a year?

15Does everyone use a personal account, with no shared accounts?

16Are administrator accounts separate from the ones used every day?

17Do all PCs and servers have up-to-date, centrally managed antivirus/EDR?

18Are laptops encrypted?

19Are requests to change bank details verified by phone on a number already known?

20Is there a written procedure for handling a security incident?

21Has anyone tested restoring the backups in the last 6 months?

The next step

From answers to evidence.

A questionnaire asks you to show, not to declare. In the assessment I verify the controls on your systems and give you the evidence to answer with.

Review the assessment

For professional firms (accountants, lawyers, notaries) there is the StudioSicuro review.