We are in the middle of a vendor security assessment from a national underwriter right now. It is long, it is specific, and it wants evidence rather than assurances. That is normal for a software company and I don’t resent it. What has changed is who else is getting one. In the last year I have watched the same style of questionnaire land on independent title agencies, sent by lenders and by underwriters, and I have watched most of those agencies answer it the way they answer the cyber insurance application: quickly, optimistically, and without reading what they were representing. It is Cybersecurity Awareness Month, so let’s talk about the document that is actually going to test your security posture this year.

Why It Is Reaching You Now

The mechanism is third-party risk management rolling downhill. A lender’s regulators require it to manage the risk of its vendors. An underwriter’s lender customers require the same of the underwriter. You are a third party to both of them, you handle their customers’ funds and non-public information, and the easiest way for them to document that they manage that risk is to send you the same questionnaire they send everyone else. ALTA’s Best Practices have included an information security pillar for a decade; the difference is that a Best Practices attestation is you saying you comply, and a questionnaire is them asking you to prove it, control by control.

What a Real One Asks

The questions are not exotic, which is part of what makes them dangerous. Is multi-factor authentication enforced on email, on remote access, and on your production system, for every user including the owner? Are SPF, DKIM, and DMARC configured on your domain, and is DMARC set to reject? Is there endpoint protection on every machine, including the closer’s laptop at home? What is your patching cadence, and can you show when the last critical patch was applied? Are backups taken, encrypted, stored off-site, and, the question that catches almost everyone, when did you last restore from one to prove they work? Is there a written incident response plan, and has it been exercised? When someone leaves, how fast is their access removed, and who checks? Do you review who has access to what, and how often? Do your own vendors have SOC 2 reports, and have you read them? Is data encrypted in transit and at rest? Does staff complete security training, and can you show completion records? Is there a business continuity plan, and the July 23 post on the tornado covered why that one is more than a checkbox.

Every one of those has a yes-or-no shape. Every one of them is really asking for a document.

The Undocumented Yes Is Worse Than the Honest No

Here is the trap. The questionnaire feels like a form, so people fill it out like a form. MFA, yes. Backups, yes. Incident response plan, yes, we’d figure it out. Training, yes, we talked about phishing in the staff meeting. But the completed questionnaire is a representation to a counterparty, and after a loss it will be read as one. A “yes” you can’t evidence is not a passing answer; it is a liability you signed.

A documented “no” is better. “No, MFA is not yet enforced on the production system; scheduled for Q1 2027” is an answer a risk team can work with, because it tells them you know what the control is and have a plan. “Yes” followed by a breach that shows MFA was never on is a different conversation, and the August 25 post on cyber insurance explained what that conversation does to a coverage claim.

Build the Evidence Folder Once

You do not need a security team to answer this well. You need an afternoon and a folder. For every control, one artifact: a screenshot of the MFA enforcement policy, the DMARC record, the endpoint console showing every device covered, the patch report, the backup job log and the dated note from the last restore test, the incident response plan as a document with a date on it, the offboarding checklist with a recent example, the training completion report, the SOC 2 letters from your vendors. Date each artifact. When the next questionnaire arrives, and there will be a next one, you answer it in an hour instead of a week, and every answer points at something.

The side effect is the real benefit. Assembling the folder is the first honest audit most independents ever do of their own posture. The gaps you find while looking for evidence are the gaps an attacker would have found first.

You Are Allowed to Send One Too

The flip side is the part I most want independents to hear. You are a counterparty with file data, escrow funds, and non-public information too, and every vendor that touches any of it should be able to hand you a SOC 2 report or a completed security questionnaire within a week of being asked. The September 10 post listed the four questions to ask about where your file data goes when a vendor calls an AI; this is the broader version. Send the questionnaire. If a vendor stalls, hedges, or tells you they’ll get back to you after the sales cycle, that is the answer, and it is a more useful answer than anything in the demo.

We will send you ours. Not because it is flattering, every honest questionnaire has a “no, planned for” somewhere in it, but because a vendor that won’t show you theirs is asking you to carry a risk they won’t describe.

The Agencies That Answer Fast Will Win Lenders

One last mechanism. Lenders are consolidating the title agencies they will work with, and the security review is becoming one of the gates. An agency that returns a complete, evidenced questionnaire in two days is a different kind of counterparty than one that takes three weeks and a follow-up call. Being able to answer well is about to be a sales advantage, not just a compliance cost. The afternoon you spend building the folder this October is the cheapest business development you will do all year.

Ask us for our completed security questionnaire →