Microsoft 365 security

I have been using Office (Microsoft) 365 for 6 years for my business and store our files on Onedrive.  One of my vendors is requiring us to complete a detailed questionnaire regarding the security steps we use with our data and also what we do if there is a breach.  Does 365 have these security measures or should we have another vendor or IT company handle it.?