What you'll get
- 3 copy-ready blocks
- 5 min read
A security questionnaire is where enterprise deals go quiet, mostly because the vendor starts writing answers the week it arrives. The fix is a starter pack: your real answers to the 15 questions that always appear, maintained like a product. This page gives the answer patterns and the honesty rules; your own facts fill them in.
The two rules before any answer
1. Never overstate. A questionnaire answer is often contractually
relied on. One discovered exaggeration retires every other answer.
2. A no with a plan beats a vague yes. Reviewers price unknowns
higher than gaps.The no-with-a-plan pattern, used throughout:
"Not currently. [What we do instead that addresses the risk.]
[If planned: scheduled for [quarter].] Happy to discuss whether this
is blocking for this engagement."The 15 questions that always appear, with answer patterns
ACCESS AND PEOPLE
1. Who can access customer data?
Name the roles, the rule (least privilege) and how access is
granted and removed. Small team is fine; undefined team is not.
2. Do you enforce MFA?
Yes or the no-with-a-plan. This one is cheap to fix before answering.
3. Background checks and security training?
State what actually happens, including "informal but documented".
4. What happens when an employee leaves?
The offboarding checklist, in two lines. Have one before answering.
DATA
5. What customer data do you store, and where?
The honest inventory: categories, regions, providers. "We do not
store [x]" is a strong answer where true.
6. Is data encrypted in transit and at rest?
State what your providers give you and what you configured.
7. How is customer data separated from other customers'?
Describe your actual model plainly: separate databases, row-level,
logical separation. Do not borrow architecture words you cannot
defend on a call.
8. Data retention and deletion?
What is deleted, when, and what a customer can request. If there is
no policy yet, this is the week to write the one-pager.
OPERATIONS
9. How do you manage vulnerabilities and patching?
The honest cadence, plus what is automated via your platform
providers.
10. Do you have monitoring and logging?
What is logged, how long it is kept, who looks at it.
11. Incident response: what happens if you are breached?
The one-page plan: who leads, when customers are told, in what
timeframe. Write it before the first questionnaire; it is the
most-read answer in the pack.
12. Business continuity and backups?
Backup frequency, where they live, whether restore has been tested.
"Tested restore in [month]" is worth more than a long paragraph.
THIRD PARTIES AND PROOF
13. Which subprocessors do you use?
The real list with purposes. Enterprises check; surprises here
reopen every other answer.
14. Do you have certifications (ISO 27001, SOC 2)?
Only claim what you hold, with dates. Otherwise: the honest
position, what your providers hold, and any audit roadmap.
Never imply a provider's certificate is yours.
15. Can you share policies and evidence?
Keep a shareable folder: policies, architecture one-pager,
insurance certificate. Offering it unprompted shortens reviews.The pack to build once
Answering from scratch each time is why questionnaires take three weeks. Build the pack when the first enterprise conversation starts, not when the spreadsheet lands: the 15 answers above in a living document, the incident response one-pager, the subprocessor list, the offboarding checklist and the evidence folder. Review it quarterly. The enterprise sales one-pager puts procurement readiness on the quarter's plan for exactly this reason, and the questionnaire's cousin, the RFP, gets the same prepare-first treatment in the bid or no-bid scorecard.
Worked example (illustrative, not a real company)
Tessaro Analytics gets its first 200-row questionnaire from a logistics group. Instead of answering rows in order, the team maps them to the 15 patterns: 160 rows are variants of the standard questions and fill from the pack in a day. Question 14 gets the honest no: no certification yet, providers' certificates listed, an audit scoped for next year. Question 11 attaches the one-page incident plan. The reviewer's only follow-up call is about data regions, answered live. Review closed in nine days; the previous vendor had taken six weeks and was still arguing about row 40. All names are invented.
Five mistakes to avoid
- Answering optimistically. "Yes" to MFA you plan to enable next month is a discoverable lie in a document the contract references. The no-with-a-plan exists so you never need one.
- Borrowing your providers' credentials. Your platform's certification covers their infrastructure, not your practices. State both layers honestly; reviewers know the difference and respect vendors who do.
- Treating it as legal homework. Slow, defensive answers read as risk. Fast, plain answers from a maintained pack read as competence, and competence is what the review is really measuring.
- Answering 200 rows one by one. Map them to your 15 standard answers first; most questionnaires are the same questions wearing different numbering.
- Building nothing between deals. Every questionnaire improves the pack if the new questions get folded in. The second review should be quicker than the first.
Why this works on named accounts
Common questions
How should a small vendor answer a security questionnaire?
From a maintained pack, fast and plainly: state what is actually true, use the no-with-a-plan pattern for gaps and attach evidence unprompted. Reviewers are pricing risk, and unknowns cost more than honest gaps with dates.
What if we do not have ISO 27001 or SOC 2?
Say so, state what your infrastructure providers hold, describe your actual practices and give the audit roadmap if one exists. Many enterprise reviews pass small vendors without certification when the fundamentals (access control, encryption, incident plan, backups) are demonstrably real.
How long should a security review take?
With a prepared pack, days; without one, weeks, and the deal cools while it drags. The preparation is a sales investment: the vendor who returns the questionnaire inside a week is telling the buyer what working together will feel like.
More from the Academy
Enterprise Sales One-Pager
For founders and sales leads at small firms chasing large accounts.
You leave with a single fill-in page: five named accounts, an entry problem and first project for each, the committee, a procurement pack check and five weekly counts.
RFP Bid or No-Bid Scorecard
For services firms that bid on everything and win little.
You leave with a ten-question scorecard, three veto questions that end the discussion alone and a no-bid letter that keeps the door open.
Software Project Proposal Template
For IT services firms whose proposals vanish into silence.
You leave with nine sections in the order a committee actually reads, the scope wording that prevents disputes and a decision ask with a date on it.
Want this in your inbox?
Optional. We use your email only to send you this, nothing else.