Compliance & Regulated Industry IT Guide
IT That Holds Up When an Auditor, Insurer, or Regulator Asks
HIPAA, SOC 2, ISO, and industry-specific compliance built into your technology from the start, for Chicagoland healthcare, legal, financial, non-profit, and manufacturing businesses.
Security questionnaires and compliance, answered directly
By Joe Engelking, CEO. Updated October 2026.
What is a security questionnaire?
A security questionnaire is a detailed form that an insurer, customer, vendor, partner, or regulator sends to ask how you protect data. It typically covers your policies, tools, backups and recovery, employee training, and best practices. Your answers help them decide whether to insure you, hire you, or keep doing business with you.
What do security questionnaires ask about?
They ask about security information and event management (SIEM), log retention, remote monitoring and management (RMM), automation, patch management, firmware updates, employee training, access controls, backups, and incident response. Many of these terms are unfamiliar to business owners, and a single questionnaire can run 20 pages.
Who should fill out a security questionnaire for a small business?
Ideally the person who actually manages your IT, with the owner signing off. Guessing is risky, because your answers become promises that an insurer or customer may rely on. We fill these out with our clients and take responsibility for them, then make sure what was claimed is actually in place.
What is the difference between HIPAA, SOC 2, and ISO 27001?
HIPAA is a US law that protects health information, so it applies to healthcare providers and the businesses that handle their data. SOC 2 is an independent audit report on a service provider’s security controls. ISO 27001 is an international standard for running an information security program. A questionnaire may ask about any of them.
| Topic | What they want to know | What has to be in place |
|---|---|---|
| Logging and SIEM | How activity is logged and how long logs are kept | Logs collected in one place and kept for the required period |
| Remote monitoring (RMM) and automation | How devices are managed and monitored | Every device enrolled, with automated checks and alerts |
| Patch management and firmware | How quickly updates are applied | Software and firmware updated on a schedule, with records |
| Employee training | Whether staff are trained on security | Regular training with proof of completion |
| Backups and recovery | Whether you can restore after an incident | Tested backups and a documented recovery plan |
How we handle a 20-page security questionnaire
Hartmann Electric does work at O’Hare Airport, so they have to meet certain regulatory standards to win jobs. That means they get sent a 20-page questionnaire full of questions about things they do not deal with day to day: SIEM, log retention, RMM, automations, patch management, firmware updates, employee training, and more.
We fill it out with them, and we take responsibility for the answers. Then we make sure they are actually compliant with what they filled out.
Joe Engelking, CEO
What happens during a compliance audit readiness review?
We compare your current policies, controls, and evidence against the framework that applies to you, such as HIPAA, SOC 2, or ISO, and list the gaps in priority order. You come away with a plan for closing them before an auditor or a customer’s security questionnaire finds them.
How long does it take to prepare for a compliance audit?
It depends on how much documentation and control work is already in place and on which framework applies. Closing gaps usually takes longer than people expect, so we start with a readiness review and give you a timeline based on what we find.
"For most of our clients, compliance starts with a questionnaire. An insurer, a customer, or a regulator sends over pages of questions about things the owner has never had to think about. We fill it out with them and take responsibility for it, and then we make sure what they told the other side is actually true. An answer on a form is a promise, and we make sure it is one they can keep."
— Joe Engelking, CEO
Direct Help With the Framework You Need
HIPAA Compliance
For healthcare practices and any business handling protected health information.
Learn more →SOC 2 Compliance
For service providers whose customers need proof of real security controls.
Learn more →ISO Compliance
For businesses formalizing information security management to international standards.
Learn more →Compliance & Regulated Industries, Explained
What compliance actually requires in the industries we work with most.
Healthcare
Legal
Finance & Tax
Need to Be Ready Before an Audit, Not During One?
Free 15-minute consultation. No pressure, no sales pitch.