Worth reading:MFA enabled, mailbox compromised: session theft
Book a consultation

Diagnostic tool

Are you ready for your client’s security questionnaire?

Twenty controls covering confidentiality, access, updates, backups and suppliers. The result shows whether you can answer today and what to fix first.

21 questions Calculated in your browser

Who it is for

Who it is for

Owners, management and IT managers of companies and ICT suppliers that have received, or expect, a security questionnaire from a client.

Do you provide ICT services to banks or insurers? What they will ask of you under DORA.

How it works

Indicate who sends you questionnaires, then answer the 20 questions. The index, the outcome and the number of blocking points appear straight away. The list of points where you are most exposed, with what to do for each, appears after you have left your email.

What it can indicate

  • Whether you can answer today without declaring controls that are not in place.
  • Which minimum requirements are missing: one or more of them means a “Not ready” outcome.
  • What to do where you are most exposed, starting with the blocking points.

What it cannot do

  • It is not a certification or a check of your systems.
  • It does not anticipate the outcome of a questionnaire: each client assesses against its own criteria.

The questions

Answer based on your current situation. If you are not sure, choose “Not sure”: in a questionnaire you cannot declare what you do not know, so it counts as “No”.

Your clients

1Who sends you security questionnaires?

Minimum requirements

A “No” or “Not sure” on any of these questions makes the outcome “Not ready”.

2Have all employees and contractors who see client data signed a confidentiality undertaking?

3When someone leaves the company, is their access closed within 24 hours?

4Is two-factor authentication mandatory on email, cloud, remote access and administrator accounts?

5Is remote access only through a VPN or an equivalent system with MFA, with no remote desktop exposed to the internet?

6Is client data always encrypted in transit (TLS 1.2 or higher), including in file exchanges?

7Are critical security updates installed within 14 days?

8Is no system used for work out of support (e.g. Windows 10 without updates)?

9Could you notify a client of an incident affecting them within 24 hours?

10Are there regular backups with at least one offline or immutable copy?

11Can you tell clients which suppliers have access to their data?

Other controls

12Is there a written security policy, approved by management and updated in the last year?

13Are security risks assessed at least once a year?

14Do staff receive security training at least once a year?

15Does everyone use a personal account, with no shared accounts?

16Are administrator accounts separate from the ones used every day?

17Do all PCs and servers have an up-to-date, centrally managed antivirus or EDR?

18Are laptops encrypted?

19Are requests to change an IBAN verified with a phone call to a number already known?

20Is there a written procedure for handling a security incident?

21In the last 6 months, has anyone tried restoring the backups?

The next step

From answers to evidence.

A questionnaire asks you to demonstrate, not to declare. With an assessment of your systems, I verify the controls and give you the evidence with which to answer.

Book a compliance consultation