Security questionnaire
A customer sent a security questionnaire. Now what?
Somewhere between the demo and the contract, an enterprise buyer sends a spreadsheet with 180 questions about your security. You can answer maybe sixty of them. This is how to handle the rest without lying and without losing the deal.
The rule
Never answer yes to be polite
Questionnaire responses are usually incorporated into the contract by reference. That turns a generous yes into a contractual statement about your company, and an inaccurate one into a misrepresentation you have signed. Buyers know you are small. They are not expecting a bank's controls. What ends deals at the diligence stage is finding out an answer was not true, which is a different and much worse conversation than finding out a control does not exist yet.
The format that gets accepted, over and over: no, here is what we do instead, here is when that changes. Three clauses. It converts a gap into a plan, and most reviewers move on.
Six traps
What goes wrong, in order of how often we see it
Answering for the company you intend to be
The questionnaire asks what you do today. A control you plan to add next quarter is a no with a date, not a yes.
Letting a non-technical person fill it in alone
Most wrong answers come from reasonable guesses about infrastructure. The person who configured it should check every technical answer.
Treating the policy questions as paperwork
If you answer that you have an incident response policy, a buyer may ask for it. Do not claim documents you cannot produce within a day.
Ignoring the subprocessor questions
Every tool that touches customer data counts, including the analytics and support tools nobody thinks of as infrastructure.
Starting from scratch each time
Keep every answer. The second questionnaire overlaps the first by most of its content, and the gap between a week and an afternoon is entirely whether you kept notes.
Not flagging what you are fixing
A gap with a committed date reads as competence. The same gap with no plan reads as a risk nobody is managing.
How to work through one
Five steps, roughly two days with help
- 01
Sort before you write
Hour one
Split every question into three piles: yes and we can evidence it, no and we know it, and we do not understand the question. The third pile is usually larger than anyone admits, and it is where the wrong answers come from.
- 02
Answer the certain ones
Day one
Start with what you can prove today. Momentum matters, and it shows you the shape of what is left.
- 03
Turn each no into a plan
Day one
What you do instead, and the date it changes. Pick dates you will actually hit, because some buyers check at renewal.
- 04
Fix the cheap gaps first
Day two
Some answers move from no to yes in an afternoon. MFA everywhere, a written access review, logging you actually keep. Do those before submitting rather than promising them.
- 05
Keep the answer bank
Ongoing
Store every question and answer with the evidence attached. The next questionnaire is mostly the same questions, and this is the difference between a week and an afternoon.
If you want help
$1,200–$2,500per questionnaire
We go through it with you, draft the technical answers, flag what is not defensible yet, fix the cheap gaps, and build the answer bank so the next one is quick. We cannot answer on your behalf, because the answers have to be true of your company, not ours.
Book a callFAQ
Common questions
What is a security questionnaire?
A list of questions a prospective customer sends before they will buy from you, covering how you protect their data. They range from a dozen questions to several hundred. Common standard formats are the SIG from Shared Assessments, the CAIQ from the Cloud Security Alliance, and the VSA from Vendor Security Alliance, but most enterprises send their own spreadsheet instead.
Can we just answer yes to everything?
No, and it is the most expensive mistake available to you. These answers are usually incorporated into the contract by reference, so an inaccurate yes becomes a misrepresentation you signed. It also tends to surface later, during an incident or a renewal audit, at the worst possible moment.
What do we do about the questions where the answer is no?
Answer no, then say what you do instead and when the gap closes. Buyers expect a young company to have gaps. What ends deals is discovering the gap was hidden, not that it existed. A clear no with a date attached is often accepted on the spot.
How long does one take?
The first one is brutal, commonly a week of founder time, because every answer has to be worked out from scratch. After that it drops sharply, since most questions repeat across buyers. Building a reusable answer bank from the first one is the highest-value hour you will spend.
Will having SOC 2 make these go away?
Largely, yes. Many buyers accept a SOC 2 report in place of the questionnaire, which is the main commercial reason to get one. Until then you answer them individually. See our SOC 2 readiness page if the questionnaires are becoming a pattern.
Can you answer it for us?
We work through it with you. We cannot answer on your behalf, because the answers describe your operations and have to be true of them. In practice we go through it together, draft the technical answers, flag the ones that are not defensible yet, and build the answer bank so the next one takes an afternoon.
Let's talk
Tell us what you're building.
Get a free 30-minute strategy call. You'll leave with a clear plan, a realistic estimate and our honest opinion — whether or not you work with us.
- Email usmail@voliom.com