The Client Security Questionnaire Is the New RFP: How to Ace It
Corporate clients now vet your security before they sign, and a weak answer can cost you the engagement.
Why this landed on your desk
Outside counsel guidelines used to be about rates and staffing. Now they arrive with a security questionnaire attached, sometimes 100 questions long, asking how you encrypt data, who can access matters, and what happens if you get breached. The client's own auditors and insurers are pushing these requirements downstream to every firm they hire.
The firms that win this work are not the most technical. They are the ones who can answer clearly and back it up. A vague or blank answer reads as risk, and risk loses engagements.
What they are really asking
Most questionnaires cluster around the same themes: encryption of data at rest and in transit, multi-factor authentication, access controls tied to the matter, logging and monitoring, incident response, vendor management, and staff security training. They also ask whether you align to a recognized framework such as NIST CSF, ISO 27001, or SOC 2.
You do not need every certification on day one. You do need honest, consistent answers and evidence you can show: a policy document, a screenshot of MFA enforcement, a training completion report.
Build the answer once, reuse it forever
Create a master security response: a living document that holds your standard answers, supporting policies, and proof. When the next questionnaire arrives, you are editing, not starting over. This turns a two-week fire drill into a one-day review.
Keep it current. A questionnaire answer that contradicts what your systems actually do is worse than no answer, because it can become a representation the client relies on.
How Pinnacle helps
We sit with your firm, map your environment to the controls clients ask about, and fix the gaps that would otherwise sink an answer. Then we help you assemble the evidence into a clean response package you control.
The result: you stop dreading these forms and start using strong security as a reason clients should pick you.