A partner forwards an email from a bank client: a spreadsheet of questions about endpoint protection, backups, multifactor authentication and incident response, due back within ten working days. For South African law firms, accounting practices and consulting firms this is now part of keeping a client.
This checklist explains where the questionnaires come from, what each group of questions is asking, and what evidence a mid-size firm should be able to produce without a scramble. It complements our professional services page.
Why your clients are asking
Two sets of rules sit behind most questionnaires.
The first is Joint Standard 2 of 2024, the cybersecurity and cyber resilience standard issued by the Financial Sector Conduct Authority (FSCA) and the Prudential Authority. It commenced on 1 June 2025 and binds banks, insurers, retirement funds, market infrastructures and a range of financial services providers. It does not bind their advisors directly, but it tells the institution to identify the information assets that third parties manage, to define security roles in contracts with them, to protect those assets in line with their sensitivity and, where it relies on a third party's own control testing, to confirm that the testing is adequate. The only way a bank can do that for its panel attorneys and auditors is to ask them. We covered the institution's side in Financial Services Cybersecurity: Meeting FSCA Requirements.
The second is the Protection of Personal Information Act (POPIA). Section 19 requires a responsible party to secure personal information with appropriate, reasonable technical and organisational measures, to identify foreseeable risks, to maintain safeguards and to verify regularly that they work. Section 21 requires a written contract whenever an operator processes personal information on a responsible party's behalf, and obliges the operator to notify the responsible party immediately if it has reasonable grounds to believe the information has been accessed by an unauthorised person. A firm that processes a client's customer or employee data is often an operator, so the client needs evidence that section 19 is met on its behalf.
Neither law prescribes a questionnaire. Both make it the practical tool for the client's compliance team.
What the questions are asking
Formats differ, but the substance falls into six groups. The Joint Standard's own control requirements are a good guide to what the client expects to see.
Endpoint protection and response
Expect questions about anti-malware on every device and whether you can detect and respond to indicators of compromise rather than only block known files. The Standard asks for endpoint protection against malware and its delivery channels, current signatures with regular scans, and detection and response that monitors endpoints for anomalies. Evidence: an agent inventory covering every partner laptop and office workstation, and a recent detection report. We run SentinelOne for this.
Identity and remote access
Questions about multifactor authentication (MFA) for email, remote access and administrator accounts. The Standard requires MFA for users of critical system functions, for privileged accounts and for accounts that reach sensitive applications over the internet. Evidence: an export of the MFA or conditional access policy, and the list of exempted accounts, which should be short and explained. If matter files are delivered through Citrix or Secure Private Access and never leave the data centre, say so.
Patching and vulnerability management
Questions about how quickly security patches are applied and what happens when one cannot be. The Standard expects patches within a timeframe that matches the risk, compensating controls where no patch exists, and regular vulnerability assessments. Evidence: a monthly patch compliance report per device, which N-able N-central produces.
Backup and recovery
Questions about backup frequency, encryption, offsite or offline copies, and tested recovery objectives. The Standard asks for regular, tested backups, encrypted backup media stored offline or offsite (cloud storage counts), and recovery point and recovery time objectives set to the risk profile. Evidence: the backup job history, the retention policy and the result of the last restore test. Cove Data Protection covers laptops, servers and Microsoft 365 data; our RTO and RPO guide explains how to set defensible targets.
Data loss prevention and confidentiality
Questions about controls on copying, emailing or uploading sensitive documents, and on separating client matters. The Standard requires data loss prevention policies for data in motion, at rest and in use. Microsoft Purview data loss prevention policies can cover Exchange email, SharePoint, OneDrive, Teams messages and Windows or macOS endpoints, and can warn, block with a justified override or block outright; a policy can run in simulation mode before it is enforced. Purview information barriers restrict chat, calls and file sharing in Teams, SharePoint and OneDrive between defined groups, which separates lawyers on opposing matters. Evidence: the policy list and a sample of recent matches. We configure both under our Microsoft 365 service.
Incident response and notification
Questions about whether you have a written incident response plan, when you last tested it and how quickly you will notify the client. POPIA section 22 requires notification of the Information Regulator and affected data subjects as soon as reasonably possible after a compromise is discovered; section 21 requires an operator to notify the responsible party immediately. Because the Standard requires institutions to report material incidents, your contract will usually set a short notification window. Evidence: the plan, the date of the last tabletop exercise and the client's notification contact. Our POPIA compliance update covers the notification duty.
Keep the evidence, not just the answers
Firms that find questionnaires easy treat each control as something that produces a report on a schedule. A monthly pack with the endpoint coverage report, the patch compliance report, the backup job summary and the MFA exception list, plus an annual restore test and incident response exercise, answers the next questionnaire in hours.
One caution. Answer only what is true, and do not present a control as a guarantee: a backup strategy with tested restores is a stronger answer than a promise that data can never be lost.
Sources
- Information Regulator (South Africa): POPIA Condition 7, Security Safeguards (sections 19 to 22), accessed 29 October 2026.
- Protection of Personal Information Act 4 of 2013, section 19, section 21 and section 22, accessed 29 October 2026.
- FSCA and Prudential Authority, Joint Standard 2 of 2024: Cybersecurity and Cyber Resilience Requirements, accessed 29 October 2026.
- Moonstone: Cybersecurity Joint Standard, commencement date confirmed, accessed 29 October 2026.
- Microsoft Learn: Data loss prevention policy reference, updated 5 October 2026 and accessed 29 October 2026.
- Microsoft Learn: Learn about information barriers, accessed 29 October 2026.
Need the controls and the reports behind them? See how OAS secures professional services firms.