Five Owner Questions Before a Customer Demands a Security Assessment

NIST just gave small businesses a primer on how assessments work. Here is what any owner should ask — in plain language — before the customer sets the calendar.

You do not need a federal contract to wake up to a customer security packet. Manufacturers ask suppliers. Hospitals ask vendors. Professional-services firms ask subcontractors. The email lands with a deadline, a spreadsheet, and the quiet threat that renewal depends on “evidence.”

On September 16, 2026, NIST published SP 1352, a small-business primer for assessing SP 800-171Ar3 requirements around Controlled Unclassified Information (CUI). My compliance write-up covers the document itself. This piece is for owners and boards: five questions that keep you from outsourcing judgment — or panicking into theater.

If an MSP already maps your stack to NIST language, good. You still need answers in owner words — one sentence you can ask, and a written reply you can file.

The assessment is a business deadline dressed as a technical project. Own the questions; let specialists own the screenshots.

Why This Is an Owner Problem

Assessments fail for business reasons more often than for exotic cryptography: unclear scope, shared logins, missing training records, and no one who can find last year’s evidence. Cyber-insurance questionnaires ask related questions. A customer security review rarely waits for your perfect roadmap. SP 1352’s value for leaders is permission to plan before someone else schedules you.

Five Questions Every Owner Can Ask This Month

1. What customer data could put us “in scope” — and who said so?

Ask sales and operations for a one-page list of customers who mention CUI, restricted data, or security addenda. If nobody can name the data types, ask the customer in writing. Scope fights are cheaper before the audit week.

2. Who owns the evidence folder — by name?

Policies, config exports, tickets, and training attestations need an owner. “IT” or “the MSP” is not a name. Put one internal owner and, if needed, one MSP contact on a dated sheet.

3. What is the one sentence I should send our MSP this week?

Try: “Please confirm which systems might process customer restricted or CUI-like data, what assessment evidence we already have, and the top five gaps before our next customer security review — in writing by Friday.” That is an owner ticket, not an architecture debate.

4. Will this also show up in cyber insurance or board reporting?

Underwriters increasingly ask about access control, MFA, backups, and incident response — themes that overlap assessment readiness. Ask your broker what evidence they want this renewal cycle, then reuse the same folder for customer asks. Banks, credit unions, and CPA firms feel this acutely; so do clinics, manufacturers, and professional services.

5. What does “good enough for this quarter” look like?

Pick a finish line: scoped systems list, unique admin accounts, MFA on privileged users, backup restore test dated this quarter, and a training attestation. Perfect is the enemy of renewable contracts. Dated progress beats a glossy binder with no dates.

What “Good Enough” Looks Like This Month

One-page customer/data scope note with a date.
Named evidence owner (internal) plus MSP contact if applicable.
Written MSP reply to the one-sentence ticket above.
Insurance and customer questionnaires feeding the same evidence folder.
Calendar block titled “assessment prep” before the next customer deadline.

This is stewardship. NIST’s primer helps your team understand assessment language; your questions keep the business from treating that language as someone else’s problem until it is too late.

If you want a fractional CISO to turn these five questions into a one-page owner packet — MSP ticket included — Security Medic can help. Calmly, with evidence, not theater.

References

NIST SP 1352 publication page (Sep 16, 2026): nist.gov/publications/…
NIST CSRC News, Small Business Primer for SP 800-171Ar3: csrc.nist.gov/News/2026/…
DOI: doi.org/10.6028/NIST.SP.1352