The security questionnaire: answer it once, then keep the answers current
For law firms, settlement agents and other firms that work for lenders and servicers, one of the most demanding reviewers in 2026 does not work for a government. It sits in a client's third-party risk department, and it communicates by spreadsheet.
Why the questionnaires keep coming
Your clients answer to someone as well. Federal guidance expects lenders and servicers to assess the security of the vendors they rely on, and the Safeguards Rule (16 CFR 314.4(f)) requires financial institutions to choose service providers that can protect customer data and to keep overseeing them. When a servicer or lender sends you a hundred questions or more, it is meeting an obligation of its own. That has three consequences for you:
- The review cannot be waived, however long you have worked together.
- It will return every year, and again at renewals, at onboarding and after incidents.
- Each round tends to be longer than the last.
Two ways firms respond
The scramble. The questionnaire arrives and is forwarded to the IT provider, who answers perhaps a third of it. The rest becomes a search for policies that may not exist, screenshots of settings and carefully worded approximations. It consumes weeks of partners' time and produces answers no one would want audited, and the following year it begins again.
The file. The questionnaire arrives and is answered from a maintained evidence file: current policies, dated records for each control, a vendor register, records of incident-plan tests, and last year's answers matched to this year's questions. That takes days. Because each answer points to something real, the follow-up questions become fewer.
A useful way to see it: a security questionnaire describes your existing program in someone else's format. If the program exists and produces records as it runs, answering the questionnaire is largely a matter of formatting. If it does not, careful wording will not fill the gap.
What the first questionnaire should change
The first serious questionnaire tells you that your firm is now large enough for its clients to manage it as a risk. Getting through it is the immediate task. The more valuable step is to build a capability that lasts:
- Establish what applies. Know which obligations attach to your firm before a client's checklist decides for you. Its questions draw on 16 CFR 314, 23 NYCRR 500 and NIST CSF language, whether or not it says so.
- Keep the evidence file current. Each control should have a dated record, refreshed as part of the program's normal operation.
- Keep one set of standard answers. Most questionnaires ask about the same forty or so matters in different words. Answer each one once, then adapt the wording for each client.
- Track what you commit to. Each yes in a questionnaire is a promise that a later audit can test. Someone should keep a register of those promises.
The advantage
Firms that can return a questionnaire in days build a reputation with the clients who matter most, and risk teams compare notes. Being the firm whose answers arrive promptly, with the evidence attached, is a commercial advantage that outlasts any single relationship.
Crucible Cybersecurity Compliance provides security and compliance services and does not provide legal advice. Regulatory citations are provided for reference; consult counsel on legal questions.