Skip to content

Customer security questionnaires

Answer your customer's security questionnaire with evidence for every answer.

Larger customers ask about MFA, admin rights, backups and how you handle security incidents. We check your Microsoft 365, close the gaps and back every answer with evidence from your tenant.

Book an introductory call How it works
For
Companies with 50 or more employees on Microsoft 365, including those with an external IT provider
Trigger
A security questionnaire or supplier assessment from a customer
Topics
MFA, admin rights, backups, updates, email protection, incident handling
Outcome
Answer and evidence per question, prioritised measures for open points
Price
from €3,500, fixed price for the Security Assessment as the first step

Sound familiar?

A customer wants to know how secure you are

For companies with 50 or more employees on Microsoft 365 that have received a questionnaire or supplier assessment and need to answer it reliably.

The questionnaire is on your desk

The questions are specific. The answers are spread across Entra ID, Defender and Intune.

"It's all set up"

Your IT provider says yes. There is no dated report you could attach.

Your customer falls under NIS2

They must secure their supply chain and pass requirements on to you, even if you are not in scope yourself.

From questionnaire to evidence

How does a question become evidence?

We map every question to the Microsoft 365 setting that answers it. Switch the view to see which evidence goes with each answer.

Choose view
Your tenant Microsoft 365, Entra ID, Intune
read-only
Your customer's questions Questionnaire or supplier assessment
  1. 1 Is MFA enabled for all users? Setting: Entra ID › Conditional Access, authentication methods Limit exclusions to emergency access accounts Is MFA enabled for all users? Partial Priority high Evidence: policy export with exclusions
  2. 2 Who has administrator rights? Setting: Entra ID › Roles, Privileged Identity Management Activate admin roles only when needed and for a limited time Who has administrator rights? Open Priority high Evidence: role assignments, activation history
  3. 3 Are backups tested? Setting: Microsoft 365 Backup Set up backup, test restores Are backups tested? Open Priority high Evidence: restore test log
  4. How quickly are updates installed? Setting: Intune › Update rings, Defender Vulnerability Management How quickly are updates installed? Evidenced, tenant report attached Evidenced Evidenced
  5. 4 How is email protected? Setting: Defender for Office 365, SPF, DKIM, DMARC Enforce DMARC step by step How is email protected? Partial Priority medium Evidence: DMARC record, protection policies
  6. 5 Who acts in a security incident? Setting: Defender XDR, written incident process Document the incident process with responsibilities and contact chain Who acts in a security incident? Partial Priority medium Evidence: documented plan, exercise log

Example. Questionnaires differ from customer to customer. Each question is mapped to the setting that evidences the answer. Open points are closed by risk. Until then, the answer states the exception and the date.

Example: your customer's questions from the questionnaire or supplier assessment are matched against your tenant, which is collected read-only. Current state per question with the Microsoft 365 setting: MFA for all users in Entra ID Conditional Access and authentication methods partial; administrator rights in Entra ID roles and Privileged Identity Management open; tested backups with Microsoft 365 Backup open; updates with Intune update rings and Defender Vulnerability Management evidenced; email protection with Defender for Office 365, SPF, DKIM and DMARC partial; incident handling with Defender XDR and a written incident process partial. Answer with evidence by priority: 1 limit exclusions to emergency access accounts, evidence policy export with exclusions; 2 activate admin roles only when needed and for a limited time, evidence role assignments and activation history; 3 set up backup and test restores, evidence restore test log; 4 enforce DMARC step by step, evidence DMARC record and protection policies; 5 document the incident process with responsibilities and contact chain, evidence documented plan and exercise log.

How does it work?

From the questionnaire to answers you can evidence. After the Security Assessment, you decide how to proceed.

  1. 30 minutes

    Introductory call

    Review the questionnaire, deadline and scope together.

  2. Fixed price, read-only

    Security Assessment

    Check Microsoft 365, Entra ID, Intune and Azure, current state per question.

  3. Based on findings

    Close the gaps

    Close open points by risk, either by us or by your IT provider.

  4. Per question

    Evidence the answers

    Every answer backed by an export or report from the tenant, exceptions stated openly.

  5. Your choice

    Ongoing evidence

    With Managed Security, a monthly evidence report.

Has a customer sent you a questionnaire?

In a 30-minute introductory call we review the questionnaire and scope, followed by a fixed-price proposal for the Security Assessment.

Request the fixed-price Security Assessment Book an introductory call

Managed Security

The next questionnaire goes faster

With Managed Security you receive an evidence report every month. When the next customer asks, the evidence is already there.

Evidence every month

For example on MFA, admin roles and device compliance, showing where each is configured in the tenant.

Monitoring and incidents

We monitor your Microsoft 365 and contain incidents within agreed response times.

Evidence ready to hand

The next questionnaire starts with current reports instead of a search through the portals.

Frequently asked questions

We are not in scope of NIS2. Why is our customer asking?

Supply chain security is one of the measures under Section 30 BSIG. Regulated customers therefore often pass requirements on to their suppliers by contract, for example on MFA, logging or reporting paths, including to companies that are not in scope themselves.

Is there a standard questionnaire?

No. Every customer asks differently, in scope and wording. We map each question in your questionnaire to the Microsoft 365 setting that evidences the answer.

What if we cannot answer a question with yes today?

Then answer as far as you can evidence it and state the exception with a date for implementation. We or your IT provider close the gap.

What does the support cost?

The first step is the fixed-price Security Assessment, from €3,500 depending on the size of your environment. We then quote the help with the questionnaire and closing the gaps based on the findings.

Which questions can your tenant evidence today?

The Security Assessment gives you the current state with its evidence source, at a fixed price.

Book an introductory call