How to Answer a Security Questionnaire as a Startup
Your first B2B prospect just sent a 200-row security spreadsheet. You do not need a security team or SOC 2 to answer it well. You need a short set of documents written once, the 12 controls that show up on nearly every questionnaire, an answer library you reuse, and the discipline to say No honestly with a compensating control and a date.
Key takeaways
- Most questionnaires are a standard form or a variant of one: Shared Assessments SIG (Lite and Core), the Cloud Security Alliance CAIQ (now v4.1) and EDUCAUSE's HECVAT for higher education.
- Buyers ask because suppliers are a real breach path: Verizon's 2026 DBIR says breaches involving a third party now account for 48% of all breaches.
- Write six to eight documents once (security overview, policy, DPA, subprocessor list, incident response plan, insurance certificate) and paste from them for every questionnaire after.
- A tiny team can honestly say Yes to most common controls using cloud defaults, MFA, SSO, backups, logging, Dependabot alerts and a written offboarding checklist.
- Never overclaim. Answer No with the compensating control in place and a target date; a false Yes can become a contract problem later.
On this page 18
- TL;DR
- Why your prospect sent you 200 rows
- The standard questionnaires and who publishes them
- The documents to prepare once
- The 12 controls that show up on nearly every questionnaire
- How to answer No honestly
- Example answers (ours)
- A time-boxed process for the first questionnaire
- Build a reusable answer library
- Tools: trust centres and questionnaire automation
- Frequently asked questions
- Do I need SOC 2 to answer a security questionnaire?
- Is it OK to answer No on a security questionnaire?
- How long should it take to answer a 200-question security questionnaire?
- Which standard questionnaire should I fill in proactively?
- Do I need a trust centre or questionnaire automation tool?
- Ship it, then sell it
- Sources
Short answer: Treat the first security questionnaire as a one-time project, not a one-off chore. Write a handful of core documents, answer the dozen controls every buyer asks about using honest, specific language (most of them your cloud provider already covers), store every answer in a reusable library, and say No with a compensating control and a date rather than stretching the truth. You do not need SOC 2 to do any of this.
Every figure and quote below comes from the linked primary source, checked on 12 Nov 2026. The process, examples and advice are ours and are marked as such. This is not legal advice.
TL;DR#
- Know the form. Most questionnaires are the Shared Assessments SIG, the CSA CAIQ (now v4.1) or EDUCAUSE's HECVAT, or a buyer's own spreadsheet borrowing from them.
- Buyers have a reason. Verizon's 2026 DBIR says breaches "involving a third party now accounting for 48% of all breaches" (Verizon).
- Write once, reuse forever. A security overview, an information security policy, a DPA, a subprocessor list, an incident response plan and an insurance certificate answer a large share of rows.
- Twelve controls do most of the work. MFA, SSO, encryption, backups, logging, access reviews, vulnerability scanning and offboarding come up on almost every form.
- Honest No beats a false Yes. Give the gap, the compensating control and the date you will close it.
Disclosure: ZeroRaised is a launch site for bootstrapped products. We have no commercial relationship with any vendor named here and earn nothing if you buy from them.
Why your prospect sent you 200 rows#
A security questionnaire is how a buyer's procurement or security team checks that adding your product will not add risk. It is rarely personal and rarely bespoke. The person who sent it usually has to file your answers before the contract can be signed.
The pressure behind it is real. Verizon's 2026 Data Breach Investigations Report says "Third-party supply chain breaches jumped 60% (now 48% of total)" and that "Using software flaws (31%) has surpassed stolen credentials for the first time" (Verizon 2026 DBIR release). A vendor with weak patching is exactly what the questionnaire is trying to find.
Our read: the buyer is not expecting a five-person startup to look like a bank. They are expecting clear, truthful answers, evidence that someone owns security, and no surprises later.
The standard questionnaires and who publishes them#
| Questionnaire | Publisher | What it is | Access |
|---|---|---|---|
| SIG Lite / SIG Core | Shared Assessments | Standardises "the initial assessment of vendors and other third parties". The 2023 SIG Lite is "126 risk control questions"; the 2023 SIG Core "addresses 855 risk control questions" for third parties handling highly sensitive or regulated data | "not free to download"; free to members, or via an annual subscription |
| CAIQ v4.1 | Cloud Security Alliance | "a set of Yes/No questions a cloud consumer and cloud auditor may wish to ask of a cloud provider" mapped to the Cloud Controls Matrix (CCM); released 27 Jan 2026 | Downloadable from CSA, with or without an account |
| HECVAT 4 | EDUCAUSE (with Internet2 and REN-ISAC) | Higher education vendor assessment covering cybersecurity, privacy, IT accessibility and compliance; v4 merged the former Full, Lite and On-Prem versions into one file | No cost for institutions and vendors working with them |
Sources: Shared Assessments: About the SIG, CSA CAIQ v4.1, EDUCAUSE HECVAT.
CSA says the CAIQ is "what individuals will need to use to submit to the STAR Registry" (CSA). Our read: if you sell a SaaS product, completing the CAIQ once is a good investment, because many custom questionnaires borrow its structure and you can attach it when a buyer accepts a standard form instead of their own.
If you sell to UK buyers, you may also be asked about Cyber Essentials, which NCSC describes as "the minimum standard of cyber security recommended by the Government for organisations of all sizes". Certification is "priced according to the size of your organisation, starting at £320 +VAT", and it covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection (NCSC).
The documents to prepare once#
These answer a large share of rows on their own, and many questionnaires ask you to attach them.
- Security overview (or public trust page). One to two pages: where you host, how data is encrypted, who has access, how you handle incidents, which subprocessors you use. Link it from your site footer.
- Information security policy. A short, true document that names an owner and covers access control, passwords and MFA, device security, change management, vulnerability management and vendor management. Keep it short enough that you actually follow it.
- Data processing agreement (DPA). Needed for any buyer subject to GDPR. Our GDPR checklist for solo SaaS founders covers what goes in it.
- Subprocessor list. Every vendor that touches customer data, what it does and where it processes data.
- Incident response plan. Who decides, how you contain, how and when you notify customers, and where you log what happened.
- Business continuity and backup note. Backup frequency, retention, where backups live and when you last tested a restore.
- Pentest or scan summary, if you have one. If not, say so and describe your scanning instead.
- Insurance certificate. Many enterprise forms ask for cyber liability cover. See our guide to business insurance for SaaS startups for what that cover is.
For a free structure to hang the policy on, NIST's Cybersecurity Framework 2.0 (released 26 Feb 2024) is organised around six functions: "Identify, Protect, Detect, Respond and Recover, along with CSF 2.0's newly added Govern function" (NIST). NIST also publishes a small business quick start guide described as "tailored to small businesses with modest or no cybersecurity plans currently in place" (NIST quick start guides).
The 12 controls that show up on nearly every questionnaire#
This is our list from the standard forms above. For each, the honest small-team version is usually enough.
| # | Control | How a tiny team can honestly satisfy it |
|---|---|---|
| 1 | MFA on all admin and production access | Enforce MFA on your cloud console, code host, email and password manager. Prefer passkeys or hardware keys for admins |
| 2 | SSO for employees | Use your Google Workspace or Microsoft account as the identity provider for every tool that supports it |
| 3 | SSO for customers | If you do not offer SAML yet, say so and give the roadmap date |
| 4 | Encryption at rest | Cite your provider. AWS: "all new object uploads to Amazon S3 are automatically encrypted at no additional cost" since 5 Jan 2023 (AWS). Google Cloud: "Google encrypts all customer content stored at rest, without any action from you" (Google Cloud) |
| 5 | Encryption in transit | TLS on every endpoint, HTTP redirected to HTTPS, HSTS enabled |
| 6 | Backups | Automated database backups, stated retention, and a restore you have actually tested (with the date) |
| 7 | Logging and monitoring | Application and access logs kept for a stated period, alerts on errors and suspicious logins |
| 8 | Access control and least privilege | Production access limited to named people; no shared accounts |
| 9 | Access reviews | A calendar reminder each quarter to review who has access to what, with a note of the result |
| 10 | Vulnerability management | Dependency alerts plus a patching target. GitHub says "Dependabot alerts help you find and fix vulnerable dependencies before they become security risks" (GitHub Docs) |
| 11 | Offboarding | A written checklist: revoke SSO, rotate shared secrets, remove from code host and cloud, recover devices, all within a stated time |
| 12 | Incident response and notification | Your plan from the documents list, with a customer notification commitment you can meet |
Our read: if you built fast, audit your own app (exposed keys, open storage buckets, missing auth checks) before you answer. Fixing an exposed key the week before is better than describing it the week after.
How to answer No honestly#
You will have gaps. Everyone does. The pattern that works:
Gap + compensating control + date.
Do not write "Yes" for something that is partly true, and do not write "N/A" to dodge a question that applies. Questionnaire answers are often attached to or referenced in the contract. A false Yes is a liability later; an honest No with a plan is usually just a note in the buyer's risk register.
Example answers (ours)#
These are illustrative answers for a fictional two-person SaaS on a major cloud provider. Adapt them to what is true for you.
| Question | Answer | Detail |
|---|---|---|
| Do you hold SOC 2 Type II or ISO 27001? | No | We are not yet audited. Our controls are described in our security overview and policy (attached). We will reassess an audit when enterprise revenue justifies it, target review Q3 2027. |
| Is MFA enforced for all access to production? | Yes | MFA is enforced on our cloud console, code host and identity provider for both team members. Admin accounts use hardware security keys. |
| Is customer data encrypted at rest? | Yes | Data is stored on [provider], which encrypts customer data at rest by default (provider documentation linked). Database backups are encrypted with the same mechanism. |
| Do you perform annual third-party penetration tests? | No | No external test yet. Compensating controls: automated dependency alerts, monthly patching, and a vulnerability scan before each major release. First external test planned before [date]. |
| Do you support SAML SSO for customers? | No | On our roadmap for [quarter]. Today we support Google sign-in and enforce strong passwords with optional TOTP. |
| Do you have a documented incident response plan? | Yes | Attached. We commit to notifying affected customers without undue delay and within the timeframe set in our DPA. |
A time-boxed process for the first questionnaire#
Our suggested plan for a founder doing this alone:
- Hour 1: triage. Ask the buyer if they accept a standard form (CAIQ or your security overview) instead. Ask for the deadline and which sections are mandatory. Skim every row and tag it: already true, true but needs evidence, not true.
- Day 1: documents. Write or update the security overview, policy, subprocessor list and incident response plan. Most rows reference one of these.
- Day 2: answer. Fill in every row, copying each answer into your library as you go. Mark any No with a compensating control and date.
- Day 2 or 3: quick fixes. Anything you can fix in under an hour (turn on MFA everywhere, enable Dependabot, write the offboarding checklist), fix before you send, then answer Yes truthfully.
- Review and send. Read it once as the buyer would. Send with a short cover note offering a 30-minute call.
If a buyer insists on an audit report, our SOC 2 for bootstrapped startups guide covers the cost and process.
Build a reusable answer library#
The second questionnaire should take hours, not days. Keep a single spreadsheet or doc with these columns:
| Column | Purpose |
|---|---|
| ID | Your own stable ID, such as ACC-03 |
| Category | Access, Encryption, Backup, Logging, Vendor, HR, Incident, Privacy, AI |
| Canonical question | The plainest version of the question |
| Short answer | Yes / No / Partial |
| Long answer | The two to four sentences you paste |
| Evidence | Link to the policy section, screenshot or provider doc |
| Owner | Who keeps it true |
| Last reviewed | Date; review everything at least twice a year |
| Mapped to | CAIQ, SIG or HECVAT question IDs where you know them |
Our read: the "Last reviewed" column is the one that saves you. Stale answers are how honest companies end up overclaiming.
Tools: trust centres and questionnaire automation#
These tools publish your security posture on a trust page and help draft answers. Pricing as shown on each vendor's page on 12 Nov 2026:
| Tool | What it offers | Published price |
|---|---|---|
| Vanta | Compliance automation; Trust Center listed under Essentials | Quote only ("Get personalized pricing") |
| Drata | Compliance automation; links to SafeBase trust centre help | Quote only |
| Secureframe | Compliance; Trust Center and AI questionnaire response automation | No price shown |
| Conveyor | Trust Center and questionnaire automation; "Priced on usage, not access" | Custom ("Talk to sales") |
| Whistic | Third-party risk platform with Whistic Trust Center | Quote only ("Request Pricing") |
Our read: none of these is necessary for your first three to five questionnaires. A public security page, a shared folder and your answer library are enough. Revisit tooling when questionnaires arrive faster than you can answer them, or when you start a SOC 2 audit anyway.
Frequently asked questions#
Do I need SOC 2 to answer a security questionnaire?#
No. A questionnaire asks what controls you have, and you can answer it truthfully without any certification. Some buyers will ask whether you have SOC 2 or ISO 27001; answer No honestly, describe the controls you do have, and say if and when you plan to pursue an audit. Many small deals close on a well-answered questionnaire plus a security overview.
Is it OK to answer No on a security questionnaire?#
Yes, as long as you explain it. A No with a compensating control and a target date reads as honest and mature. A Yes you cannot back up is the real risk, because questionnaire answers are often referenced in the contract and can be checked later.
How long should it take to answer a 200-question security questionnaire?#
The first one is the slowest because you are writing your answer library and documents as you go. Our rough plan is two to three focused days for the first, then a few hours for later ones because most answers are copy, check and paste from your library.
Which standard questionnaire should I fill in proactively?#
If you sell a cloud product, the CSA CAIQ is a sensible one to complete in advance because it is designed for IaaS, PaaS and SaaS providers and can be submitted to the CSA STAR Registry. If you sell to universities, expect the EDUCAUSE HECVAT. Larger enterprises often send the Shared Assessments SIG, which requires a membership or subscription to obtain.
Do I need a trust centre or questionnaire automation tool?#
Not for your first few questionnaires. A public security page plus a shared folder of documents covers most early deals. Tools such as Vanta, Drata, Secureframe, Conveyor and Whistic offer trust centres and questionnaire automation, but all of them were quote-only on their pricing pages on 12 Nov 2026, so budget for a sales call.
Ship it, then sell it#
Security answers close deals, but first you need a product people can find. Run through our product launch checklist for bootstrapped makers, then submit your product to ZeroRaised for free. For more practical guides on selling without investors, join the ZeroRaised newsletter.
Sources#
- Verizon: Vulnerability exploitation top breach entry point, 2026 DBIR finds, last checked 12 Nov 2026
- Shared Assessments: About the SIG, last checked 12 Nov 2026
- Cloud Security Alliance: STAR Level 1 Security Questionnaire (CAIQ v4.1), last checked 12 Nov 2026
- EDUCAUSE: Higher Education Community Vendor Assessment Toolkit, last checked 12 Nov 2026
- NCSC: Cyber Essentials overview, last checked 12 Nov 2026
- NIST: NIST releases version 2.0 of landmark Cybersecurity Framework, last checked 12 Nov 2026
- NIST: CSF 2.0 quick start guides, last checked 12 Nov 2026
- AWS: Amazon S3 default encryption FAQ, last checked 12 Nov 2026
- Google Cloud: Default encryption at rest, last checked 12 Nov 2026
- GitHub Docs: About Dependabot alerts, last checked 12 Nov 2026
- Vanta pricing, last checked 12 Nov 2026
- Drata pricing, last checked 12 Nov 2026
- Secureframe pricing, last checked 12 Nov 2026
- Conveyor pricing, last checked 12 Nov 2026
- Whistic pricing, last checked 12 Nov 2026
Frequently asked questions
Do I need SOC 2 to answer a security questionnaire?
No. A questionnaire asks what controls you have, and you can answer it truthfully without any certification. Some buyers will ask whether you have SOC 2 or ISO 27001; answer No honestly, describe the controls you do have, and say if and when you plan to pursue an audit. Many small deals close on a well-answered questionnaire plus a security overview.
Is it OK to answer No on a security questionnaire?
Yes, as long as you explain it. A No with a compensating control and a target date reads as honest and mature. A Yes you cannot back up is the real risk, because questionnaire answers are often referenced in the contract and can be checked later.
How long should it take to answer a 200-question security questionnaire?
The first one is the slowest because you are writing your answer library and documents as you go. Our rough plan is two to three focused days for the first, then a few hours for later ones because most answers are copy, check and paste from your library.
Which standard questionnaire should I fill in proactively?
If you sell a cloud product, the CSA CAIQ is a sensible one to complete in advance because it is designed for IaaS, PaaS and SaaS providers and can be submitted to the CSA STAR Registry. If you sell to universities, expect the EDUCAUSE HECVAT. Larger enterprises often send the Shared Assessments SIG, which requires a membership or subscription to obtain.
Do I need a trust centre or questionnaire automation tool?
Not for your first few questionnaires. A public security page plus a shared folder of documents covers most early deals. Tools such as Vanta, Drata, Secureframe, Conveyor and Whistic offer trust centres and questionnaire automation, but all of them were quote-only on their pricing pages on 12 Nov 2026, so budget for a sales call.