A managing partner called me last spring, about an hour after a corporate client had emailed over a vendor security questionnaire. One hundred and eighty questions, a spreadsheet, thirty days to return it. The client was the firm's second largest. Nobody at the firm could answer section four, and nobody at their IT provider could either.
This is not a rare call any more. It's a normal Tuesday.
Your corporate clients are getting audited. SOC 2 and ISO 27001 both require an organization to manage the risk that comes from the outside parties who touch its data, and to be able to show evidence that it does. Once a company commits to that, it has to push the obligation down to its vendors. And a law firm holding litigation files, deal documents, employee records and privileged communications is, in the language of that framework, a vendor with a lot of access.
Your client's auditor never asks about your firm. They ask your client what your client knows about your firm. The questionnaire is how your client finds out.
The same pressure arrives through a second door: outside counsel guidelines. Security requirements have been quietly appearing in OCGs for years, and firms sign them without routing them past anyone technical. Sometimes the questionnaire is just a client checking whether the thing you already agreed to is true.
They look intimidating because they're long, but almost every questionnaire is the same five clusters wearing different numbering.
Roughly seventy percent of the questions are things your firm either does or doesn't do, and answering them is clerical. The trouble lives in the other thirty.
"Describe your offboarding process and provide evidence of its execution." Most firms have a process. Most firms cannot produce evidence of it. When we take over an environment, finding active accounts belonging to people who left months ago is closer to the rule than the exception, and the mailbox delegations left behind are usually worse than the accounts.
"Do you back up data held in Microsoft 365, and how often are restores tested?" This one has two traps in it. The first is that many firms answer yes when what they mean is that Microsoft holds their data. Microsoft keeps the service running and protects itself against its own failures; it does not protect you from a deleted mailbox, a retention policy nobody reviewed, or ransomware encrypting a synced OneDrive. The second trap is the word "tested". A backup nobody has ever restored from is a belief, not a control.
"Provide your written information security policy and the date of last review." Two answers fail here, and one of them looks fine. Having no policy fails. So does a policy that was written in 2019, last reviewed in 2019, and clearly downloaded from somewhere. A short policy that genuinely describes what your firm does, reviewed this year, beats forty pages of aspiration.
"Have you experienced a security incident in the last 24 months?" The instinct is to say no. The better answer is the true one, with what you did about it. A firm that reports a contained phishing incident and describes the response reads as a firm that would tell you if something happened. A firm with a spotless record and no detection capability is the one that worries a reviewer, because it may simply mean nobody was looking.
This is the word that separates a questionnaire you can answer in a week from one that eats a month. Evidence is not a claim. It's an artifact with a date on it: an export showing MFA enforcement, a screenshot of a restore test, a signed policy, an access review with names and a date, a spreadsheet of terminated users next to the dates their accounts were disabled.
Firms that keep evidence as they go answer the questionnaire out of a folder. Firms that don't reconstruct it under deadline while also practising law.
If nobody has sent you a questionnaire yet, you have the easy version of this problem. Five things, in this order.
Ask the client for the deadline in writing, and ask whether partial answers with a remediation timeline are acceptable. They very often are, and a firm that says "we don't do this yet, here is when we will" is treated far better than a firm that guesses. Then answer the clerical seventy percent first so you can see the real gap, and be honest in the remaining thirty. Reviewers are not looking for a perfect score. They are looking for a vendor who knows what's true about their own environment.
The firms that come out of this well are not the ones with the biggest IT budgets. They're the ones who had already written things down.