Client Security Questionnaire? Answer It From Evidence, Not Memory

Client security questionnaires ask the same Microsoft 365 questions again and again. Answer them from a current evidence report of your tenant's configuration, not from memory or a folder of old screenshots, and keep that report so the next questionnaire takes hours instead of days.

For Philippine firms that serve foreign clients, such as BPOs, accounting and audit support teams, and software developers, the security questionnaire is now part of winning and keeping work. It arrives before a contract, at renewal, or after a client has its own audit. This article covers what those questionnaires usually ask about Microsoft 365, why answering them is harder than it looks, and how Posturis, the Microsoft 365 security posture assessment we built ourselves, gives you the evidence to answer from.

The short answer

Most questions about your Microsoft 365 environment can be answered from its configuration: whether multifactor authentication is enforced, who holds administrator roles, how email is protected and who can share files externally. Read that configuration once, keep the result as evidence, and answer from it. When a client asks for proof, you can show the relevant pages instead of describing what you believe is set.

What questionnaires usually ask about Microsoft 365

• Access: is MFA required for every user, and are legacy sign-in methods blocked?
• Administrators: how many people hold admin rights, and are those accounts protected?
• Email: how are phishing, malicious links and attachments handled?
• Data sharing: can staff share files with anyone outside the company, and are guest accounts reviewed?
• Devices: are company laptops managed and encrypted?
• Logging: are sign-ins and administrator actions recorded?

Many questionnaires are built on frameworks such as ISO/IEC 27001 or NIST, so the questions are phrased as controls even when the client is not asking for a certification.

Why answering from memory goes wrong

The person filling in the questionnaire is often not the person who configured the tenant, and settings change. An exception added to fix one sign-in problem, a site opened to everyone because it was quicker, or a consultant who kept admin rights after a project: any of these can make a confident answer untrue. An answer that turns out to be wrong in a later audit damages the relationship more than an honest gap would have.

Screenshots are the usual fallback. They take days to gather, show one setting at a time, and are out of date within weeks.

How Posturis gives you the evidence

Posturis reads your Microsoft 365 configuration and evaluates it against 46 controls across identity and access, Identity Protection, device management, email and collaboration, data sharing, and app and tenant governance. Each run leaves three files in your own SharePoint:

• An HTML report to read and share internally.
• A Word evidence pack you or an assessor can annotate, with each finding mapped to frameworks such as ISO/IEC 27001, NIST CSF, the CIS Microsoft 365 Foundations Benchmark, SOC 2 and the Philippine Data Privacy Act.
• An Excel control sheet with one row per control, easy to match against a questionnaire's rows.

Posturis is read-only and changes nothing in your tenant. Every finding comes with remediation guidance, so a gap you discover while answering a questionnaire comes with a way to close it. Our article on using an evidence report for ISO work covers the audit side in more detail.

What Posturis does not cover

A questionnaire also asks about things no configuration report can show: written policies, staff training, background checks, physical security and business continuity plans. Posturis covers the Microsoft 365 configuration part. Be clear with your client about which answers come from evidence and which from policy documents. The output is evidence for your answers, not a certificate, and it does not make you compliant with any standard on its own.

Frequently asked questions

Can we send the Posturis report to our client?

The report is yours and sits in your SharePoint, so you decide what to share. Many organisations share selected pages or the control sheet rather than the full report.

Does Posturis change anything in our Microsoft 365 tenant?

No. It is read-only. Its only write is the report files, to the SharePoint site you nominate.

Is a Posturis report an audit report or certification?

No. It is control evidence. Certification is decided by an accredited body, and an audit opinion comes from an auditor.

Does it help with Data Privacy Act questions?

It maps findings to the technical security measures the Act expects, which helps you answer the Microsoft 365 part. Our article on Data Privacy Act security measures covers the rest.

Where to start

1. Collect the questionnaires you have answered. List the Microsoft 365 questions that repeat.
2. Run a baseline assessment. Keep the three files as your evidence set.
3. Map the questions to controls. The Excel sheet makes this a one-off job.
4. Close the easy gaps first. MFA, admin accounts and external sharing are common quick wins.
5. Re-run before each renewal. Answer from a current report, not last year's.

Posturis is available by arrangement.

Onprem2Cloud IT Solutions Co. is a Microsoft CSP partner based in Muntinlupa City, Metro Manila. See Posturis alongside our other in-house software on the software page, or contact us to arrange a run.