Data protection
Security questionnaires: a fast-track process
Every enterprise deal now arrives with a spreadsheet of 80 to 400 questions about your security. Answering it from scratch each time is slow, inconsistent and legally risky. A fast-track process makes it a two-day task instead of a two-week one.
47Do you encrypt data at rest? Yes.Yes — AES-256 at rest for all customer data in production databases and object storage; keys managed in the cloud provider’s KMS with annual rotation. Backups are encrypted with the same scheme. See SOC 2 Type II report, CC6.1.
- Build one master answer set, reviewed once by engineering and legal; every questionnaire is then a mapping exercise, not a writing exercise.
- Every answer is a representation. “Partial, with a compensating control” is almost always acceptable; a false “yes” is a breach on day one.
- Keep the questionnaire and the security addendum consistent — the addendum is the contract, the questionnaire is evidence of what you promised in it.
Why questionnaires stall deals
A security questionnaire arrives after the commercial terms are agreed and before signature — the worst possible moment. It goes to whoever in engineering has time, who answers what they know and guesses the rest; legal sees it after it has been sent, if at all; and the buyer’s security team comes back with follow-ups on the guesses. Two weeks later the deal that was closed is still open, and three different customers have now been told three different things about your backup encryption.
Step one: the master answer set
Take the three or four most comprehensive questionnaires you have received — or a standard set such as the SIG or CAIQ, which many buyers use as a base — and answer every question once, properly. Each answer has four parts:
- The answer: yes, no, or partial.
- The control, named specifically: not “we encrypt data” but which data, with what, where the keys live.
- The scope: production only? All environments? Backups?
- The evidence: the SOC 2 control reference, the policy document, the pen-test summary.
Engineering writes the controls; legal reviews the wording, because each answer is a statement the company is making to a counterparty. Once agreed, the master set is the only source. Nobody answers a questionnaire freehand again.
Step two: routing
A new questionnaire is mapped against the master set. Questions with an existing answer are filled by whoever runs the process — this does not need an engineer. Questions with no match go to one of three owners: engineering (technical controls), legal (contractual and privacy questions, which appear in every questionnaire and are routinely answered wrongly by engineers), or leadership (insurance, corporate, financial questions). New answers go back into the master set.
Step three: what to say when the answer is no
Serious buyers do not expect every answer to be yes. They expect honesty and a plan. The options:
| Situation | Answer | Do not |
|---|---|---|
| Control exists in a different form | “Partial — we do X instead of Y, which addresses the same risk because…” | Say yes because it is “basically the same” |
| Control is planned | “No — planned for Q2; interim control is…” | Say yes because it will be true by go-live |
| Control is not relevant to your architecture | “Not applicable — we are multi-tenant SaaS; there is no customer-specific hardware” | Leave blank |
| Control does not exist and is not planned | “No.” Then explain why the risk is acceptable or mitigated elsewhere | Say yes |
A false yes is not a negotiating tactic; it is a misrepresentation, and the liability cap in the master agreement may not protect the company from it. Buyers who later discover it do not renew.
Step four: consistency with the addendum
The security addendum is the contract. The questionnaire is evidence of what the company said before signing it. They must agree. If the addendum commits to a 24-hour breach notification and the questionnaire says 72, the more onerous one will be argued to apply and the discrepancy will be used against you. Before signature, someone compares the two — on a desk, this is a standard step.
The fast-track in numbers
With a maintained master set, a 200-question enterprise questionnaire takes a day to map and a day for the owners to close gaps. Without one, two to three weeks is normal, and the answers drift every time. The master set is the highest-return two days of work in a security programme that most companies never do.
A questionnaire tracker — master answer set structure, owner routing, and a consistency check against the addendum — is on the tools list for this site. Until it is published, the table above is the structure.
Next step
Have a contract like this on your desk?
Send it over. We will mark it up and walk you through it in twenty minutes — no cost, and you will know whether the desk is worth it.