Challenges
Answering a customer's or insurer's security questionnaire
Questionnaires ask about multi-factor authentication, endpoint detection, tested backups and patching. They are easy to answer when the controls are in place and dangerous to answer when they are not.
The challenge
A larger customer sends a supplier security questionnaire, and your cyber insurance renewal asks much the same: is multi-factor authentication on for every user, do you have endpoint detection and response, are backups tested, are devices patched? With 150 staff, laptops at home and Microsoft 365 close to its default settings, nobody is sure of every answer, and you do not want to tick a box you cannot back up.
If it is left
A questionnaire answered optimistically is a liability. An insurer can decline a claim where the answers did not match the controls; a customer can end a contract over it; and the gaps it hides are the ones an attacker finds. Left unanswered, the tender closes and the renewal goes through at a higher premium or with exclusions. The questions are the same ones every year, and the same ones Cyber Essentials asks, so the work done once answers all of them.
What good looks like
Every answer true and evidenced: multi-factor authentication on every account, endpoint detection and response on every device with Microsoft 365 sign-ins monitored, devices patched on a schedule, backups with tested restores, a password manager, staff trained, and regular reports that show it. The next questionnaire takes an afternoon, and if a customer wants the certificate, Cyber Essentials falls out of the same controls.
What to do first
Before you call anyone
Read the questions as a list of controls
Group them: identity (MFA, passwords, admin accounts), devices (endpoint protection, patching, encryption), data (backups, tested restores), people (training), and governance (policies, incident plan). Most questionnaires are those five groups in a different order.
Answer only what you can show
For each question, note the evidence you would hand over if asked: a screenshot, a report, a policy. If there is no evidence, the honest answer today is no, and that is the gap list.
Check the three that fail most often
Multi-factor authentication for every user on every cloud service, not only administrators; the date of the last restore you actually tested; and whether the firewall and routers get updates at all.
Ask the insurer what they weight
Brokers will say which answers move the premium and which are conditions of cover. It tells you where to spend first.
Do not let the deadline write the answers
A questionnaire can usually be returned with a dated plan for the gaps. A false yes cannot be undone.
To see where you stand on all five controls, take the Cyber Essentials check. You get the result straight away, with no name or email needed.
What we would do first
-
Find the gaps
An IT wellness assessment reviews your devices, network, access and backups, and reports the security risks in plain language with a plan ranked by risk.
-
Secure every sign-in
Multi-factor authentication for every user, Entra sign-in policies, legacy sign-in methods blocked, and Microsoft 365 sign-ins monitored for account takeover.
-
Protect, patch and back up
Microsoft Defender and Huntress endpoint detection and response on every computer, laptop and server, devices kept up to date, and backups monitored with restores tested.
-
Have the evidence ready
Regular reports of what was detected and done, and Cyber Essentials certification if customers ask for it, with help preparing the evidence.
How we approach it
-
Map the questionnaire to the estate
An IT health check reviews devices, network, access, backups and Microsoft 365 against the questions you have been sent, and reports which you can answer yes to today, which need a control, and which need only evidence gathering.
-
Identity first
Multi-factor authentication for every user through Entra Conditional Access, legacy sign-in protocols blocked, separate admin accounts, Keeper for strong unique passwords, and Huntress identity monitoring watching Microsoft 365 sign-ins for a stolen password in use.
-
Devices and data
Microsoft Defender with Huntress endpoint detection and response on every computer, laptop and server, Intune enforcing encryption and configuration, patching on a schedule including routers and firewalls, and backups of servers, laptops, Azure and Microsoft 365 with a tested restore.
-
People and policy
Security awareness training with simulated phishing, and the written policies a questionnaire asks to see, such as acceptable use, incident response and the AI use policy, drafted with you.
-
Evidence on tap
Regular reports of what was detected and done, the inventory, the restore test results and the training completion, kept so the next questionnaire is an afternoon's work, with Cyber Essentials certification if a customer asks for the badge.
The services that apply
-
Endpoint and identity protection
With it in place, you can answer yes to the questions about endpoint detection and response and Microsoft 365 monitoring, and its reports are the evidence.
-
Backup and recovery
Insurers ask whether backups are tested, not whether they exist; the scheduled restore tests and their results are the answer.
-
IT health check
The way to find out which answers are true today, with the gaps ranked by risk, before anything is submitted.
-
Cyber Essentials consultancy
Many questionnaires accept the certificate in place of a page of questions, and the five controls are the shortest route to the rest.
-
Password management
Unique passwords on every account, controlled admin rights and leavers' access removed centrally answer the identity questions insurers weight most.
-
Complete Managed IT
Patching on a schedule, an inventory and a monthly report are the answers to the device questions, and they come from the managed service.
How you would buy it
Every hour we work falls under one of four engagement models. These are the ones that fit this situation; How we work compares all four.
-
02
Fixed price
A defined piece of work or project
The health check is a fixed fee, and closing the gaps it finds, from multi-factor authentication for every user to backups with a tested restore, is surveyed and priced as a fixed sum before the questionnaire is due.
-
03
Retainer
The way most of our clients work with us
Keeping the controls in place and the evidence current is managed service from your retained hours, so each year's questionnaire is answered from reports that already exist.
Who you would work with
A tech consultant
Maps the questionnaire to your estate, runs the health check and helps you word answers that are true.
Our engineers
Put the controls in place: multi-factor authentication, endpoint protection, patching, backups and the password manager, as Odyssey employees.
An account manager
Keeps the renewal and tender dates in view and gathers the evidence pack when the next questionnaire lands.
Further reading
-
Guide
Securing Microsoft 365: why Conditional Access is non-negotiable
Microsoft 365 lets people work anywhere, and so can attackers. Conditional Access policies keep the flexibility and cut the risk.
Read the guide →
Questions people ask
Can you help us fill in the questionnaire?
Yes. We complete it with you: a tech consultant maps the questions to your estate, answers the technical ones from the controls and the evidence, and drafts the rest with you so every answer is one you can stand behind. It is submitted in your name.
What is Cyber Essentials, and will it satisfy the questionnaire?
A UK government-backed scheme certifying five basic security controls: firewalls, secure configuration, user access control, malware protection and security update management. Many customers accept the certificate in place of their own questions, and insurers often ask for it; some questionnaires go further, which the health check shows.
Do we have to use Odyssey to fix what the assessment finds?
No. The plan is yours to act on however you choose, with us or with your own team, and the fee is fixed before we start, so the review has no reason to find work.
Can you set up multi-factor authentication for every user?
Yes. Multi-factor authentication for every user through Entra Conditional Access, legacy sign-in methods blocked, and Microsoft 365 sign-ins monitored for account takeover, which is the identity answer most questionnaires weight heaviest.
Do you provide endpoint detection and response?
Yes. Microsoft Defender is backed by Huntress managed endpoint detection and response on every computer, laptop and server, watched around the clock by Huntress analysts and acted on by our engineers.
What evidence can we show a customer or insurer?
Regular reports of what was detected and done, the device inventory and patch status, the restore test results, the training completion figures, and Cyber Essentials certification if customers ask for it.
What if the honest answer to a question is no?
Say no, with a dated plan for the gap. Insurers and customers accept a plan; they do not accept a false yes, and a claim can be declined on one.
How long does it take to get to yes on everything?
It depends on the gaps. Multi-factor authentication and endpoint protection can be rolled out quickly; backups with a tested restore and a policy set take longer. The health check gives you a realistic timeline against your deadline.
Talk to a human about a security questionnaire
Call and we answer within three rings. Or tell us what you need and we will call you back at any time.