Managing client accounts at an agency

How an agency should answer a client's security questionnaire

Map each question to a standard control area, such as identity and access. Describe what you do today, explain shared logins, and date any planned fix.

Updated October 16, 2026

Clients send security questionnaires in different shapes. Some use a standard set, such as the Cloud Security Alliance’s CAIQ. Others send their own spreadsheet. Either way, the questions about accounts fall into a small number of standard control areas. Once you see which area a question belongs to, you know what the client is asking about your client accounts, and what your answer has to cover.

Why clients send questionnaires

Some clients have a legal reason. Your agency may process consumers’ personal information for a client that is a “business” under the California Consumer Privacy Act (CCPA). If so, the client’s contract with you must let it take “reasonable and appropriate steps” to help ensure you use the information properly (Cal. Civ. Code 1798.100(d)(3)). The regulations say those steps may include ongoing manual reviews and regular assessments or audits at least once every 12 months (11 CCR 7051(a)(6)). A business that never enforces the contract or audits its providers might not be able to argue later that it had no reason to suspect misuse (7051(c)). A questionnaire is a low-cost way for a client to take such a step.

Some clients may also face cybersecurity audits under the CCPA regulations. The rule covers businesses whose processing presents “significant risk” to consumers’ security, as defined by revenue and data volume thresholds (11 CCR 7120). For businesses with 2026 revenue over $100 million, the first audit report is due April 1, 2028 (7121(a)(1)). Where they apply, the audit must assess several areas that reach your agency (7123(c)):

Multi-factor authentication, including phishing-resistant methods, for service providers and contractors as well as employees.
Limiting a service provider’s access to what the contract’s business purposes need.
Restricting and monitoring the creation of accounts for service providers.

A client under these rules has its own reason to ask how your staff get into its accounts.

Some questionnaires ask whether you have a SOC 2 report. SOC 2 is one of the System and Organization Controls services that CPA firms provide. A CPA examines a service organization’s controls relevant to security, availability, processing integrity, confidentiality or privacy, and reports on them. How client accounts fit into your agency’s SOC 2 audit and client security reviews covers what auditors ask about client accounts. If you don’t have a report, say so, and ask whether detailed answers will do. Then answer the control questions with what you actually do.

Where your work involves no personal information, the reason to ask comes from the contract and the relationship. The way to answer is the same.

How the questions map to control areas

The Cloud Security Alliance (CSA) publishes the Cloud Controls Matrix (CCM), a control framework with 197 control objectives in 17 domains. Its questionnaire, the CAIQ, turns the controls into yes-or-no questions. CSA says no license is needed to use the CCM for internal purposes. The CCM’s domains make a useful map even for a custom questionnaire. Here is how typical account questions line up with them.

Question	CCM area	What your answer covers
“Do you control who can access which systems?”	Identity & Access Management (IAM): Identity Inventory, Least Privilege	Your list of client accounts, and which accounts each person is assigned to
“Do users share IDs?”	IAM: Uniquely Identifiable Users	Which accounts use a shared login, who knows each password, how it changes at a staff change, and how you tie each use to a person
“Do you remove access when staff leave or change roles?”	IAM: User Access Changes and Revocation	The steps for each access method, and how you confirm they took effect
“Do you keep access logs?”	Logging & Monitoring (LOG)	What each access method records per person. On a shared login, the platform records only the login
“Do you require multi-factor authentication?”	IAM: Strong Authentication	Your staff’s own logins, and who receives the codes for shared logins
“Do you manage the devices staff use?”	Universal Endpoint Management (UEM)	Whether staff use company or personal computers, and what you require on personal ones
“Do staff receive security training and sign confidentiality terms?”	Human Resources Security (HRS)	How often you train, and where confidentiality terms appear
“Do you have an incident response process?”	Security Incident Management, E-Discovery & Cloud Forensics (SEF)	The internal reporting route, and the steps to notify the client
“Do you use subcontractors?”	Supply Chain Management, Transparency & Accountability (STA)	Whether freelancers work on client accounts, and how their access is handled

On shared IDs, CSA’s text accepts unique IDs or processes “which can associate individuals to the usage of user IDs.” So where a login is shared, your answer turns on how you tie each use to a person. User Access Changes and Revocation asks for timely removal for movers and leavers. On subcontractors, the CCPA adds a rule: a service provider that brings in another person must notify the business and bind that person by written contract (1798.140(ag)(2)). For personal computers, see Letting remote staff work in client accounts from home.

The map is a reading aid. A control area tells you what the client wants to know, and your answer says what you actually do.

Three rules for writing the answers

First, describe the current state as it is. Even where the form offers only yes or no, add a note with the facts. For a question on removing access, say who does what, when, and how it gets checked. For example: “When a staff member rotates off, we ask the client to remove their invitation on delegated-access accounts, and we stop their access in our access tool on the rest. Our operations manager confirms against the account list the next business day.”

Second, if shared logins exist, describe how you manage them, not just whether they exist. Shared logins remain for reasons your agency can’t remove alone, such as a platform with no way to invite staff (Managing client accounts at an agency). For example: “Shared login in use for one marketplace seller account. The password is known to two staff members and one manager. At a staff change, we ask the client to change it. Use is recorded in a daily work log.”

Third, write “planned” only alongside a separate statement of the current state, with a deadline, an owner and how you’ll confirm completion. For example: “We will move our remaining ad accounts to delegated access by December 31, 2026. Our operations manager owns this and will confirm completion to you in writing.” Keeping the two apart means a plan that slips doesn’t make your earlier answer untrue.

Why the first answers have to be accurate

The checking doesn’t stop after selection, and each later review compares what you show with what you wrote. If you answered “no shared logins” and an audit finds one, you then have to explain why the earlier answer was wrong.

A questionnaire is your account list written out as answers. If the list is accurate, you can fill in the questionnaire from it, and an auditor will see the same list. How to answer a prospect who asks whether their accounts are safe with your agency uses the same list for the pitch.

Frequently asked questions

Why do clients send our agency a security questionnaire?

If you handle consumers' personal information for a client covered by the CCPA, its contract must let it check how you use that information. A questionnaire is one way to check, before work starts and again later.

How do we answer a question about shared logins?

Say which accounts use one, who knows each password, how it changes when staff leave, and how you tie each use to a person. A bare yes or no doesn't answer what the client is asking.

A client asks for our SOC 2 report and we don't have one. What now?

Say you don't have one, then answer the access questions with what you do today. Ask whether detailed answers will do or whether the report itself is required.

When can we answer "planned" instead of "yes"?

When you also state what is true today, and add a deadline, an owner and how you will confirm completion. A plan written as if it were done won't match a later audit.

How Junify handles this

Doing this by hand: You agree with each client on how access is handed over, add and remove people platform by platform whenever staff change, and keep track of which staff member used which client's account.
With Junify: If you change the password at setup, with the client, so only Junify holds it, you can answer the shared-login question with what is true today. Staff sign in without seeing the password. Junify records who used which client account and when, under each person's name. When someone leaves, you remove their access in Junify.

Try the demo Book a 30-minute demo