Michael J. Bannach: Who Owns the Answer to Your Next Security Questionnaire?

Here is a composite of a situation Michael J. Bannach sees often. A 300-person engineering firm receives a security questionnaire from its largest client. The help desk provider says security belongs to another vendor. The security vendor says the questions cover policies it does not own. The compliance consultant finished its engagement last year. Every vendor did its job, and nobody can answer the question.

“If nobody can name the control owner and produce the evidence, you have an accountability gap,” said Bannach, President and CEO of Stealth Technology Group (STG). “It doesn’t matter how many vendors you have or how good each one is. What matters is whether someone can answer for the whole picture.”

Why the Question Got Harder

The questions have changed faster than most IT arrangements. Insurers ask for evidence of multifactor authentication and tested backups before they renew. Clients attach security questionnaires to contracts. Defense primes flow NIST SP 800-171 requirements down to their suppliers. Employees adopt AI tools faster than policy can follow.

Providers are part of that picture. Third parties were involved in 48 percent of breaches in Verizon’s 2026 Data Breach Investigations Report. In 2022, CISA, the NSA and the FBI joined cybersecurity agencies from the United Kingdom, Australia, Canada and New Zealand in a joint advisory warning that attackers target managed service providers to reach the customers behind them.

More vendors is not automatically worse, Bannach notes, and a single provider concentrates risk of its own. The difference is ownership. “A provider with admin access to every system you own is either your strongest control or your biggest exposure,” he said. “You should know which one you have.”

A Responsibility Check Any Leadership Team Can Run

Bannach, a CISSP with more than 25 years in enterprise IT and cybersecurity, suggests an exercise that takes about an hour. Pull the last security questionnaire the company received and assign every answer a named owner, internal or external. For the controls that matter most, including multifactor authentication, backups, endpoint protection, privileged access and incident response, ask each owner for current evidence: a coverage report, a dated restore test, an inventory reconciled to the protection console.

Then look for the seams. Mark every place where two parties each assume the other is responsible. Finally, ask who owns AI: which tools employees use, what data those tools can reach and who approved them.

“Accountability isn’t a slogan,” Bannach said. “It’s being able to answer the hard question the same day it’s asked, with evidence.”

Some of the gaps that exercise exposes are fixed with a contract clause or a clear responsibility matrix. Others point to a different arrangement.

When the Answer Is a Different Partner

Bannach built STG as one accountable partner for IT, cybersecurity, compliance and AI for regulated mid-market companies, and he is candid about why many companies stay with an arrangement that isn’t working: the switch itself feels risky. Transitions go wrong when the outgoing provider holds the only documentation, when credentials live in one person’s head, or when the cutover is improvised.

STG runs transitions through a five-phase method, Stealth SmoothSwitch™: Discover, Document, Mirror, Cut and Delight. The environment is documented and mirrored before anything is cut over, so the change is planned rather than improvised.

“Most companies don’t stay with a weak arrangement because they’re happy,” Bannach said. “They stay because they’re afraid of switch day. Take that fear away and the decision gets much easier.”

The first step costs nothing but an hour: find the last questionnaire, and find out who can answer it. Companies weighing a change can see how STG approaches transitions at stealth360assurance.com.

Michael J. Bannach is President and CEO of Stealth Technology Group (STG), one accountable partner for IT, cybersecurity, compliance and AI for regulated mid-market companies and defense suppliers. STG is a Cyber AB Registered Practitioner Organization with teams serving Tampa, Sarasota, Boston and Greater Philadelphia. A CISSP with more than 25 years in enterprise IT and cybersecurity, Bannach also holds CCNP Enterprise and CCNP Collaboration certifications, a certificate in AI products and services from MIT, and an Executive MBA from Saint Joseph’s University. Learn more at michaelbannach.com and stealthtech365.com.