How to answer an enterprise security questionnaire
Answer honestly and specifically, and never leave a blank. A truthful “no, and here is our timeline” almost never loses a deal — an evasive or copy-pasted answer often does, because it tells the reviewer they cannot trust anything else on the form. Build the answers once into a reusable bank and the second questionnaire takes an hour instead of a week.
What the questionnaire is actually for
A security questionnaire is not a test you pass or fail. It is a risk file. Somebody in the buyer's security team has to write down what happens to their data inside your company, sign their name to it, and defend that assessment if you are ever breached.
That reframes every answer. The reviewer is not looking for perfection from a twelve-person startup — they know what you are. They are looking for whether you know your own posture. A company that says “we do not have formal access reviews yet, we run them ad hoc, and quarterly reviews start in March” is far easier to sign off than one that ticks every box in a way the reviewer does not believe.
The questionnaire is also how the buyer decides how much more work to do. Clean, specific answers end the review. Vague ones trigger a follow-up call, then a spreadsheet of clarifications, then a month of delay on a deal you thought was closed.
The formats you will be sent
There are only a handful in common circulation, and they overlap heavily.
- SIG (Standardized Information Gathering) — the long one. SIG Lite is the abridged version most startups actually receive.
- CAIQ — the Cloud Security Alliance's questionnaire, common when you are hosting the buyer's data.
- VSA (Vendor Security Alliance) — shorter, startup-friendly.
- A bespoke spreadsheet — most common of all. Someone's internal list, often assembled from the above.
Because they overlap, answering one properly gets you most of the way through the next. That is the entire argument for building an answer bank rather than treating each one as a fresh fire drill.
The questions that actually carry weight
Most of the form is inventory. A smaller set genuinely drives the buyer's decision, and these deserve real care:
- Do you have a SOC 2 report? The single highest-leverage line. A report attached here ends most of the review at question one.
- Who can access customer data, and how is that access reviewed? The question behind the question is whether an ex-employee still has a live account.
- Is MFA enforced on everything? Not “available” — enforced, including on your cloud provider's root account.
- Is data encrypted in transit and at rest, and who holds the keys?
- What are your subprocessors? Every vendor that touches their data. This must match your public privacy policy exactly, and reviewers do check.
- What is your incident response process, and what is the notification window? Often contractual, so the number you write may end up in the agreement.
- Do you run a penetration test, and how often?
- How do you handle offboarding? The most common place a startup's honest answer is weak — and the most common real-world breach path.
How to answer when the honest answer is no
This is the part founders get wrong, usually by hedging. The pattern that works has three parts: state the current reality, state the compensating control, state the date.
A weak answer: “Access reviews are performed regularly.” The reviewer reads that as a no with extra steps, and now doubts your other answers.
A strong answer: “We do not yet run formal quarterly access reviews. Access is limited to three engineers, granted through Google Workspace SSO, and revoked as part of offboarding. Formal quarterly reviews with documented sign-off begin in Q2, as part of our SOC 2 readiness work.”
That answer is shorter than the excuse, more useful to the reviewer, and it is defensible if they ever check. It also does something the hedge cannot: it gives the reviewer language they can paste into their own risk assessment. Make their job easy and they approve you faster.
The one thing you must never do is claim a control you do not have. If it surfaces later — during your own SOC 2 audit, or after an incident — you have a misrepresentation in a contractual document, which is a materially worse problem than the missing control ever was.
Build the answer bank once
The first questionnaire is expensive. The tenth should not be. What makes the difference is keeping the answers as reusable artefacts rather than as a filled-in spreadsheet you email and forget.
Keep, in one place: your standard answer to each recurring question, the policy each one points at, the evidence that proves it, the date it was last reviewed, and who owns it. When the next questionnaire arrives, most of it is assembly.
This is the same material a SOC 2 audit asks for, which is the real reason readiness work pays for itself before the report exists. The policies, the access review records, the subprocessor list and the incident response plan are simultaneously your audit evidence and your questionnaire answers. Doing it once serves both.
What to attach, and why it shortens the review
Most reviewers would rather read one good document than forty one-line answers. Attaching the right artefacts turns a multi-week thread into a single pass.
- Your policy set. The approved, dated versions — not drafts. Ten documents is normal for a startup: information security, access control, incident response, change management, vendor management, business continuity, risk assessment, data classification, acceptable use, and secure development.
- A recent penetration test summary. The executive summary, not the full technical report. Most buyers want to see that one happened and that findings were remediated.
- An architecture or data-flow diagram. One page showing where their data lives, which region, and which third parties touch it. This single artefact pre-empts a surprising number of follow-up questions.
- Your subprocessor list. Matching your privacy policy exactly.
- SOC 2 report or a dated readiness statement. Whichever you actually have.
If a buyer asks for something you cannot share — a full penetration test report is a common one, since it is effectively a map of your weaknesses — say so and offer the summary under NDA. Reviewers understand that refusal; they do not understand silence.
The five mistakes that actually cost deals
Across the questionnaires that stall, the same handful of errors recur.
- Claiming a control you do not have. The only genuinely unrecoverable mistake. It converts a missing control into a misrepresentation in a document that often becomes contractual.
- Leaving cells blank. A blank is read as something to hide, and it guarantees a follow-up round. “Not applicable, because we do not process payment card data” takes ten seconds and closes the question.
- Contradicting your own public documents. Reviewers open your privacy policy and your subprocessor list while reading your answers. A vendor named in one and missing from the other restarts the whole review.
- Answering with marketing language. “Bank-grade encryption” and “enterprise-ready security” mean nothing to a security reviewer and signal that nobody technical filled in the form. Name the algorithm, the provider, and the key custody arrangement.
- Taking three weeks to respond. Momentum matters. A partial response in two days, with the remainder promised by a named date, keeps the deal alive better than a perfect response a month later.
When to say the report is coming
If you do not have SOC 2 yet, say so plainly and give the buyer something concrete to hold: your scope, your observation window, and your expected report date. “Security-only scope, three-month observation window starting in March, Type 2 report expected in July” is a sentence a procurement team can plan around.
Many enterprise buyers will proceed on that basis, often with a contractual commitment to deliver the report by a named date. What stalls the deal is not the absence of a report — it is the absence of a date.
If the deal genuinely cannot wait, ask what would unblock it. The usual instruments are a completed questionnaire, your policy set, a recent penetration test, and a Type 1 as an interim. Most enterprise buyers have a process for exactly this, and asking costs nothing.
Questions people ask
How long does a security questionnaire take to complete?
The first one typically takes a week of scattered effort, because most of the time goes on finding answers rather than writing them. Once you have a reusable answer bank with the supporting policies and evidence, subsequent questionnaires usually take one to three hours, since the formats overlap heavily.
What happens if I answer no to a security question?
Usually nothing, provided the answer is specific and paired with a compensating control and a date. Reviewers expect gaps at a small company. What loses deals is a vague or evasive answer, because it makes the reviewer distrust the rest of the form and escalate to a longer review.
Does a SOC 2 report replace the security questionnaire?
Often it shortens it dramatically rather than replacing it. Many buyers accept a SOC 2 Type 2 report in place of most of the form, asking only a handful of questions the report does not cover. Some regulated buyers will still send the full questionnaire regardless, but it is far quicker to answer with a report in hand.
Can I reuse answers between different questionnaires?
Yes, and you should. SIG, CAIQ, VSA and most bespoke spreadsheets ask the same underlying questions in different wording, so a maintained answer bank covers most of any new form. Review each reused answer before sending, because a stale answer about a tool you no longer use is worse than no answer.
Who should fill out the security questionnaire?
Whoever actually knows the answers, which at a startup is usually the CTO or the engineer who owns infrastructure. Sales should not fill it in alone. The one rule that matters is that nobody claims a control that does not exist, since the completed questionnaire frequently becomes a contractual document.
See this against your own company. SOC2Starter turns 19 questions into a personalised list of what you are missing, drafts the policies, and files the evidence against the requirement it proves. Fourteen days free, no card.