ShareAndGoShareAndGo

Security

How to answer a client's security questionnaire.

Sooner or later, a growing firm wins a client big enough to have a vendor risk team. Before the engagement starts, a spreadsheet arrives with dozens or hundreds of questions about how you protect data: who can access client files, how you share them, what happens when staff leave, how you would respond to an incident.

For a small accounting practice, law office or consultancy, the first questionnaire can feel like an exam written for a different kind of company. This article explains why clients send them, how to answer honestly, and how to describe the way your firm shares documents.

Why clients send questionnaires

Many larger organizations are expected, by their own regulators, auditors, insurers or boards, to understand the risks their suppliers bring. A firm that handles their financial records, legal matters or employee information is part of that risk. The questionnaire is how the client's team gathers evidence that you have thought about it.

Some clients use a standardized questionnaire that many companies share. Others write their own. Either way, the reviewer on the other side usually has a long list of vendors to get through. Clear, specific and consistent answers make their job easier, and that tends to make yours easier too.

The golden rule: answer what is true today

The most common mistake is answering aspirationally. If a question asks whether all staff use two-step verification and three people still do not, the honest answer is "most staff, with the remainder being enabled by a stated date", not "yes". Questionnaire answers often end up attached to the contract, and a reviewer who later finds a gap between the answer and reality has a much bigger problem with you than one who saw an honest "partially".

A few habits help:

  • Answer the question asked. If it asks about client data, do not describe your marketing website.
  • Be specific. "Access is by named invitation with an end date" is better than "we take security seriously".
  • Say where an answer depends on a supplier, and name the category of supplier, such as your email provider or your document platform.
  • Keep a master copy of your answers and update it, so the next questionnaire takes an hour rather than a week.
  • Have your attorney review anything that reads like a contractual promise.

The questions about document sharing

A large part of any questionnaire concerns how client data moves. Expect questions like these, and know your answers before the spreadsheet arrives:

Question areaWhat the reviewer wants to know
Access controlWho can see client files, and how access is granted and removed
AuthenticationWhether people prove who they are before they see anything
Sharing with third partiesHow files reach people outside your firm, and whether that can be limited
LoggingWhether you can tell who viewed or downloaded a file, and when
MalwareWhether incoming files are checked before anyone opens them
OffboardingHow access ends when a person or an engagement finishes
Data locationWhere the files are kept and which services handle them

If your current answer to most of these is "we email attachments", the questionnaire is telling you something useful about your process.

How to describe ShareAndGo in your answers

If your firm uses ShareAndGo for client documents, you can describe what the product does in plain terms. Stick to what it does rather than labels, and let the reviewer draw conclusions:

  • Team members sign in through MyAndGo with Google, Microsoft or email, with two-step verification, and session timeouts are set by the workspace.
  • External recipients are invited by email and verify that address with a six-digit code before they see anything. Password links are available as an option.
  • Groups control which folders each set of recipients can see. Download, print and copy can be turned off per room and per group.
  • For view-only recipients, PDFs, Word, Excel and PowerPoint files are rendered and watermarked on our side, and the original file is not sent to their browser.
  • Invitations have an end date and can be revoked at any time.
  • Every upload is scanned for viruses, and files are not served until the scan is clean.
  • An audit log records every view, upload, download, invitation and change. Entries are chained so alterations are detectable, and the log exports as CSV.

For the data location question, use the wording on our privacy page rather than paraphrasing it, and point the reviewer to that page for the list of services involved.

Questions you should not answer alone

Some questions are really about your contract, your insurance or your legal obligations: breach notification timelines, liability for a supplier's failure, the right to audit, indemnities. Those belong with your attorney and, where relevant, your insurance broker. It is perfectly acceptable to answer "addressed in the services agreement" and let counsel negotiate the terms.

Likewise, do not claim a certification, an attestation or a legal status you do not hold, and do not imply that a supplier's tools give you one. Reviewers check, and an overstated answer can lose a client faster than an honest gap.

Turning the questionnaire into an improvement plan

The best outcome of a questionnaire is not a passing grade. It is a short list of things your firm should fix anyway. Write down every question where the honest answer was weaker than you would like, put a date and an owner against each, and revisit the list before the next one arrives. Firms that do this find each questionnaire easier than the last, and they find themselves with a better story to tell prospects who never send a spreadsheet at all.

Common questions

Can we share a previous client's questionnaire answers?
Your own answers, yes, after updating them. Never share another client's questionnaire or anything that identifies them.
What if we do not know an answer?
Say so, find out, and reply with the correct answer. A guess that turns out wrong is worse than a short delay.
Should our attorney review the questionnaire?
For anything that reads like a contractual commitment, yes.

Keep reading

Zero trust for document sharing

The principle behind most access control questions.

Tamper-evident audit trails, explained

What a chained log records, and what it does not.

Where your data lives

How to answer the data location question honestly.