For many startups, the first serious security conversation does not come from an auditor or a regulator. It comes from a sales deal. A larger client likes your product, procurement gets involved, and a spreadsheet arrives with 80 to 300 questions about how you protect their data. It often has a deadline measured in days.
It is tempting to treat the questionnaire as paperwork to get through. That is a mistake, partly because clients increasingly ask for evidence behind the answers, and partly because the questions are a fairly good map of what a mature customer expects from a supplier.
What the client is actually trying to find out
Most questionnaires are built from a standard framework such as ISO 27001, SOC 2 or a shared industry template, which is why they feel long and repetitive. Underneath the volume, the client's security team is usually checking a handful of things:
- Who in your company can access their data, and how that access is approved and removed.
- Whether accounts are protected with multi-factor authentication, especially for email, cloud consoles and admin tools.
- Where their data is stored, whether it is encrypted, and which third parties can see it.
- Whether you would notice a breach, and what you would do in the first 24 to 72 hours.
- Whether someone in your company is clearly responsible for security.
If you can give clear, truthful answers to those five areas, the rest of the questionnaire becomes much easier.
Answer honestly, even when the answer is "not yet"
The most damaging thing a small company can do is answer "yes" to controls it does not have. Security teams compare answers across suppliers and often ask for screenshots, policies or audit reports later in the process. An inconsistency discovered after a contract is signed causes far more trouble than an honest gap disclosed upfront.
Most clients do not expect a 20-person company to have the same controls as a bank. What they want to see is that you understand your risks and have a plan. An answer such as "Not currently in place. We are implementing multi-factor authentication for all staff accounts and expect to complete this by March" is usually received far better than an unexplained "no", and far better than a "yes" you cannot support.
A practical way to work through it
When we help clients with their first questionnaire, we usually follow the same order:
- Read the whole questionnaire first and group the questions by theme, such as access, data, suppliers and incidents. Many questions ask the same thing in different words.
- Answer the questions you can support with evidence today, and note where that evidence lives.
- Mark the questions where the honest answer is "partially" or "no", and agree internally which of those you can realistically fix in the next few weeks.
- Write short, specific answers. Long paragraphs tend to raise more follow-up questions than they settle.
- Keep a master copy of your answers, because the next client will ask almost the same questions.
Use the gaps to decide what to fix first
The questions you could not answer well are a useful, client-driven priority list. In our experience the same few gaps appear again and again in smaller companies: no written security policy, shared or unmanaged accounts, no multi-factor authentication on key systems, no record of which suppliers handle customer data, and no agreed plan for responding to an incident.
None of these require expensive tools to address. They do require someone to take ownership, write things down and follow through. Closing them before the next questionnaire arrives turns a stressful week into a routine task, and gives your sales team a genuine answer when a prospect asks how seriously you take security.
When to get help
If a questionnaire is tied to a significant deal, or the client is asking for a certification such as ISO 27001 or SOC 2 that you do not yet hold, it is worth getting an experienced view before you submit. A short review can catch answers that will not hold up, and help you explain your roadmap in a way the client's security team will accept.