Startups and scaleups
An enterprise customer sent a security questionnaire. Now what?
Selling software to a bank, a hospital, a university or a government agency means answering their security questionnaire, sometimes hundreds of questions long. It's often the first time a startup looks hard at its own security. The good news: most questions come back to the same controls, and fixing them helps far more than wording answers carefully.
Rather just ask someone? Talk to usIn short
Answer honestly, and fix gaps rather than wording around them. Most questionnaires check the same controls: multi-factor login, access reviews, encryption, backups, logging, vulnerability management, incident response and supplier risk. Gather evidence for each, close the gaps that matter, and say plainly what's in progress. SOC 2 or ISO 27001 helps later, but isn't always needed for a first deal.
General information, current as at November 2026, not legal advice. A review lowers risk; it can't guarantee a system won't be breached, and it isn't a certified penetration test or a compliance audit.
- What is a vendor security questionnaire?
- A list of questions a customer sends a supplier to understand how it protects their data, before signing or at renewal. Common formats include the CAIQ and SIG, or a company's own spreadsheet. Answers often become part of the contract, which is why accuracy matters more than polish.
What actually matters
Never overstate a control
If the answer is 'partly' or 'planned for March', say so. Customers accept honest gaps with a plan far more readily than they forgive an answer that turns out to be false after an incident, when it can also become a contractual problem.
Most questions map to a dozen controls
Multi-factor login, access reviews, encryption in transit and at rest, backups, logging, vulnerability management, secure development, incident response, supplier management, staff onboarding and offboarding, and data retention. Get these right and most questionnaires become paperwork.
Evidence beats assertions
Screenshots of multi-factor settings, a dependency scanning report, a backup restore record, an incident response plan, a review report. Collect them once, keep them current, and each new questionnaire takes hours instead of weeks.
A review gives you something to point to
Many questionnaires ask when your application was last independently reviewed or tested. A recent review with findings fixed answers that honestly, and prepares you for a penetration test if the customer insists on one.
SOC 2 and ISO 27001 are investments, not paperwork
They involve months of work and an independent auditor or certification body. They're worth it when enterprise deals keep asking. Until then, a well-evidenced questionnaire, a security page and a recent review often carry a first deal.
Evidence worth collecting now
Each item answers several questions on most questionnaires.
- Screenshots showing multi-factor login enforced on every admin system
- A current list of who has access to production, reviewed in the last quarter
- Proof that backups exist and a recent restore test
- Dependency and secret scanning set up on the main repository
- A short incident response plan, with names and phone numbers
- A list of subprocessors and where customer data is stored
- The date and summary of your last independent review or test
Where we'd point you elsewhere
We can help you understand the questions, close the technical gaps, gather evidence and get ready for an audit. We don't certify anyone, and we're not a SOC 2 auditor or an ISO 27001 certification body. If your customer requires an attestation, it has to come from one of those, and we'll work alongside them.
Tell us what you'd like checked
Describe what you run and what's worrying you. We'll suggest a sensible scope and a fixed price, or tell you plainly if a different kind of specialist would serve you better.
Common questions
Not always. Many enterprise buyers accept a well-evidenced questionnaire, a recent independent review or penetration test, and a plan for certification. If deals keep stalling on SOC 2 or ISO 27001, that's the sign to start the formal process.
It depends on your customers. US-based buyers usually ask for SOC 2; Australian, European and government buyers often prefer ISO 27001. Ask your target customers which they accept before committing to either.
It can draft answers from your policies and evidence, which saves time. Every answer still needs checking by someone who knows what's actually in place, because an AI will happily describe controls you don't have, and the answers may form part of the contract.
Yes, on the technical side. We review what's actually in place, close the gaps that are quick to fix, help gather evidence and explain what each technical question is asking. The answers themselves stay yours, because you're the one signing them.
See it working
Software we'd build, running with a fictional business and sample data. Use it, then decide.
Also worth a look
- Security Review vs Penetration Test
- Code and Infrastructure Security Review
- Securing Integrations and Connected Apps
- Already broken or stuck? Fix & rescue
Last reviewed . General information, not legal advice. Figures cited are from the sources named on each page.