A 200-question SIG or CAIQ from your biggest prospect, no CISO, no SOC 2 and a week to answer. A playbook to answer honestly, back it with proof and unblock the deal.
- Published
- Updated
- Reading time
- 7 min read
- By
- Zaaf review desk
In this guide
A 200-question security questionnaire just landed in your inbox from the biggest deal in your pipeline. You have five engineers, no CISO, no SOC 2, and the buyer wants answers this week. The questionnaire is one stage of a longer review, and here is how to get through it and actually close the deal.
Security questionnaires are where enterprise deals quietly die. Not because the product is insecure, but because a founder without a security function freezes, over-promises, or answers vaguely, and the buyer's security team reads that as risk. The good news: you do not need a security team to pass one. You need a system, honest answers, and one piece of real proof.
First, understand what the questionnaire is for
A vendor security questionnaire (you will see it as a SIG, a CAIQ, or the buyer's own spreadsheet) exists so the buyer's security and procurement teams can decide one thing: if we let this vendor touch our data, how much risk are we taking on? Every question maps back to that. Your job is not to look perfect. It is to look honest, in control and low-risk.
Security reviewers read hundreds of these. They can spot inflated answers instantly, and a caught exaggeration poisons the whole document. Two accurate "not yet, here is our plan" answers beat twenty confident half-truths.
- StatementDescribe the control you operate.
- EvidencePoint to a current supporting record.
- OwnerName the person who can clarify it.
Triage, then answer plainly
Read the whole questionnaire before you type anything. Sort every question into three buckets, then answer each bucket the way it deserves.
- Things you already do. State them in one clear sentence with specifics: "Data is encrypted in transit with TLS 1.2 or later and at rest with AES-256, with keys managed by our cloud provider." No adjectives, no marketing. Reviewers reward precision.
- Things you do partially. Say what is in place and what is not. A partial control described accurately is worth more than a full one claimed loosely.
- Things you do not do yet. Never leave a gap blank and never bluff it. Write what you do not have, why it is not a risk to their data today, and when it lands.
Most questionnaires repeat the same themes: access control, encryption, data handling, vulnerability management, incident response, subprocessors. You are answering categories, not 200 unique questions.
Build an answer bank so you never start from zero
Build a single source of truth: a document or spreadsheet with your standard answer to every common control, who owns it, and the record that backs it. The first questionnaire takes days. With a reusable answer bank, the next one takes an afternoon. This is the single highest-leverage thing a founder can do here.
- # Question, owner, answer, evidence
- Question Is privileged access reviewed periodically?
- Owner Platform owner
- Answer Privileged access is reviewed by the platform owner.
- Evidence Latest review record, shared on request
An example is a structure, not an answer to copy. Only use a statement like this if it matches your actual practice.
Attach evidence, because assertions are not enough
This is where most founders lose the deal. The security team does not want you to say you are secure. They want something they can verify. The strongest attachments, in order of how much a reviewer trusts them:
- A recent third-party security assessment. A report with findings remediated, for a scope that matches what the buyer will use.
- A signed attestation. A statement of what was tested and verified fixed, signed by whoever did the verifying.
- Architecture and data-flow diagrams. So the reviewer can see where their data goes and what touches it.
- Your written security policies. Access, incident response and vendor management, at minimum.
An honest questionnaire with relevant evidence makes the review easier to evaluate. It does not guarantee approval: the buyer may still identify unacceptable risks or require a specific report or control.
Handle the SOC 2 question without panicking
If a questionnaire requires SOC 2, state your current status accurately. Ask the buyer whether it will consider interim technical evidence while the required work is in progress. Do not assume that a report or attestation letter is an equivalent substitute; let the buyer tell you what it will accept.
Return it fast, then stay reachable
Speed is a security signal. A vendor who returns a complete, honest questionnaire in days looks organised and trustworthy. Offer a 30-minute call with whoever owns the answers (often the founder) to walk their security team through anything unclear. Deals stall in silence, not in dialogue.
The two mistakes that kill deals
- Over-claiming. One inflated "yes" that unravels during due diligence taints every other answer and can end the deal outright.
- Answering with words only. "We take security seriously" is not evidence. A security team needs something it can verify: a report, a proof, an attestation. Without it, the deal sits in review until the champion gives up.
You do not have a security problem. You have a revenue problem that looks like a PDF you cannot produce. Answer honestly, standardise your answers, and back the important ones with real proof, and the questionnaire stops being the place your deals go to die.
Before you send
A quick final check
Common questions
How long should a security questionnaire take to answer?
The first one usually takes days, mostly spent finding out what you actually do. With an answer bank, later ones take an afternoon. Returning a complete, honest questionnaire within a week reads as organised.
What if we do not have SOC 2 yet?
Say so plainly, give the date your observation window starts, and ask whether the buyer will consider interim technical evidence. Do not present another document as an equivalent unless the buyer agrees it is.
Is it better to answer "yes" and fix it later?
No. One inflated answer that unravels in due diligence taints every other answer. A "not yet" with a date and a reason the gap does not put their data at risk today is the answer that closes deals.
What evidence do reviewers trust most?
Something they can verify: a recent third-party security assessment with findings remediated, then a signed attestation of what was tested and fixed, then diagrams and written policies.
NoteThis describes how security questionnaires are commonly reviewed. It is general guidance, not legal, compliance or contractual advice; your buyer's requirements and your own counsel govern what you claim and share.