A deal reaches procurement and a spreadsheet arrives: 180 questions, mostly written for a company with a security department. The founder answering it has three days and a product to ship, and the temptation is obvious.
Do not take it. Vendor reviewers read hundreds of these, and they are good at spotting the pattern of a questionnaire answered aspirationally. One contradiction turns a routine review into a detailed one, and a detailed one is where deals go to stall.
The three answers that work
- Yes, with evidence attached. The strongest answer, and the reason you want documentation before the questionnaire arrives.
- No, with a date and an owner. Perfectly acceptable from a small vendor. "Not yet — planned for Q3, owned by the CTO" reads as competence.
- Not applicable, with one sentence of why. "We do not store cardholder data; payments are processed by a PCI-compliant provider" closes an entire section legitimately.
The answer that does not work is an unqualified yes to a control you implement partially. If access reviews happen when someone remembers, the honest answer is no with a date.
What to have ready before the questionnaire arrives
Most of the effort in a questionnaire is retrieval, not decision. Assemble these once and the next one takes hours rather than days.
- A current penetration test report and its retest record.
- An attestation letter you can share when the full report is too sensitive.
- A data flow description: what personal data you hold, where it lives, who it is shared with.
- A subprocessor list with links to each one’s compliance page.
- Your incident response plan, however short, with names in it.
- Access control and onboarding/offboarding procedures, plus evidence they ran — a dated access review beats a policy document every time.
- Backup and restore evidence, including the date of the last successful restore test.
- A short architecture diagram showing trust boundaries and encryption.
The questions that actually decide the outcome
Reviewers weight some answers far more heavily than others. In my experience these are the ones that move a review from routine to blocked.
| Question | What a good answer looks like |
|---|---|
| Do you perform penetration testing? | Yes, annually and before major releases, by an independent tester — report available under NDA |
| Is customer data encrypted at rest and in transit? | Yes, with the mechanism named per data store |
| How is administrative access controlled? | MFA enforced, individual accounts, access reviewed quarterly with evidence |
| Do you have an incident response plan? | Yes, with named roles, notification timelines and a date it was last exercised |
| How is customer data segregated? | Enforced at the data layer, tested with cross-tenant test cases |
When you cannot answer yes
Give the compensating control. "We do not have SOC 2. We do have an annual independent penetration test, quarterly access reviews and encrypted backups with tested restores" is a substantive answer, and reviewers can work with it.
Where the gap is genuine and material, say so and propose the timeline you can actually hit. Missing a date you volunteered is worse than the original gap.
Two habits that save the next one
- Keep a canonical answer bank in your wiki, dated, with links to evidence. Update it when reality changes, not when a questionnaire arrives.
- When you answer "no, by Q3", put the ticket in the backlog that day. The questionnaire has just given you a prioritised, customer-funded security roadmap — that is the useful part of an otherwise tedious exercise.