Your first security questionnaire

When a customer sends your startup a security questionnaire, sort it into two piles before you answer a single row. One pile is about the product you shipped: where the data sits, who can log in, whether a person can export and delete their record, whether administrative access is logged, whose name is on the cloud account. You should be able to answer those from the system. The other pile is about the company you may not be yet: a SOC 2 report, an annual penetration test, background checks, a board, a named security officer, cyber insurance. Answering the company pile with yes because the product pile is true is how founders create a document they cannot defend. The honest word for a control you do not have is that you do not have it.

The spreadsheet feels like one thing because it arrives as one file. It is two different examinations stapled together by a buyer who has done this before and a template that does not know how old you are. The document the template is usually compressing, for the security rows, is the AICPA's Trust Services Criteria. The 2017 criteria, with points of focus revised in 2022, contain 33 of 61 criteria as the common criteria. Those 33 are the complete set for a security-only examination; the AICPA's own framing is that no additional control-activity criteria are needed for security. The other four categories add criteria on top of the common criteria rather than instead of them: 3 for availability, 2 for confidentiality, 5 for processing integrity, and 18 for privacy (AICPA, 2017 Trust Services Criteria with revised points of focus — 2022). A first questionnaire that asks if you "have SOC 2" is asking whether a CPA firm has examined you against a set of that shape. It is not asking whether your login page exists.

NIST's Cybersecurity Framework 2.0, published 26 February 2024, is the other document buyers are paraphrasing, and it says the thing vendors hope you will not read. The Core is a set of outcomes arranged by Function, Category, and Subcategory, and "these outcomes are not a checklist of actions to perform; specific actions taken to achieve an outcome will vary by organization and use case." There are six Functions: Govern, Identify, Protect, Detect, Respond, and Recover (NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, 26 February 2024). A spreadsheet of two hundred yes/no rows pretends otherwise. You are allowed to answer an outcome with the evidence you actually have, and with "not in place" where you do not. You are not required to pretend a subcategory is a product feature you can toggle.

The product pile is answerable in the first release, and it should be, because you built it. Where does production data sit: which provider, which region, which account, and is that account yours. Who can authenticate, and is there a second factor on the accounts that can read every customer. Can you export one customer's data, and can you delete it, and have you done either one. Is administrative access logged somewhere you can open without filing a ticket with your vendor. Are secrets in a store, or in a repository someone cloned. These are not a maturity model. They are questions a stranger can verify in an afternoon if you are in the account with them. If you cannot answer one, the fix is in the product, and it is a better use of the week than wordsmithing the spreadsheet.

A useful answer on this pile names the object. "Data is encrypted" is not an answer. "The database volume is encrypted with the cloud provider's default key, in this region, in this account, and we have not set up a customer-managed key" is an answer. Buyers who know what they are doing prefer the second, including when it is narrower than the marketing sentence, because they can decide whether the narrower thing is enough. Buyers who wanted the marketing sentence were not going to accept the truth later either. Give them the object now.

The company pile is where startups lie, usually by accident. A SOC 2 report is an examination opinion from a CPA firm. You do not have one because you wrote a security page. An annual penetration test is a test that happened, with a letter, in a year you can name. Background checks are a process you run on hires, or they are not. A virtual CISO on a slide is not a control unless that person has an actual duty and you can say what they review. Cyber insurance is a policy or it is a plan to buy one. None of these is shameful to lack at the moment a product first has a customer. All of them are shameful to claim. The damage is not the buyer's feelings. It is the document, which will be attached to a contract, and which you will be asked to re-affirm at renewal when you still do not have the thing.

The bridge between the piles is a date and an owner, not a synonym for yes. "Not in place. The product control that covers this outcome is the audit log on administrative actions, shipped. The company control — an external test — is not scheduled. We will not describe it as done." That sentence loses some deals. It keeps the deals that would have survived the first incident. A buyer who needs a report in hand before they can sign is a buyer whose process you cannot satisfy this quarter, and pretending otherwise spends the quarter on a document instead of on the product pile you could have closed.

Sort the rows in one sitting, with the person who can open the cloud account in the room. Product pile: answer from the screen, not from memory, and attach the screenshot or the setting name. Company pile: no, not in place, or yes with the document linked. Anything you are tempted to call "in progress" needs a named person and a definition of done that is not "we are thinking about it." In progress without those two is the company pile wearing a costume. If a row does not fit either pile — a question about your customers' customers, or about a certification from a country you do not operate in — say that it does not apply, and say why in one line. Silence reads as a skip. A skip reads as a hide.

Two rows deserve special distrust because they feel like the product pile and are not. "Are you GDPR compliant" and "are you HIPAA compliant" are legal conclusions about a programme, not settings in a console. You can describe the product facts those laws care about — what you collect, where it goes, who you share it with, how a person gets it deleted — and you should. You should not convert those facts into a compliance badge in a free-text cell. If the customer needs a particular contract term, that term is a conversation for counsel, and this article is not that conversation. The same separation applies after something has already gone wrong: what you owe a person when data has been exposed is a different set of clocks, and it is not answered by the questionnaire you filled in last quarter.

Identity is the row that most often exposes a hand-rolled weekend. A password form is not an access layer. The questionnaire will ask about multi-factor authentication, about revoking a user the same day they leave, about whether an administrator's actions can be listed, and sometimes about single sign-on. Bespoke or off the shelf is the build-versus-buy version of that gap: the login screen is the small part, and the history of sensitive changes is the part the questionnaire is actually scoring. If those rows are going to be yes, the evidence has to be a setting you can open. If they are going to be no, say no, and do not let a salesperson upgrade them on the call.

What you sign in the contract with your own development partner determines whether the product pile stays true. If production sits in their account, every honest answer you write this month expires when they rotate a key you cannot see. The questions to ask before that contract exists — copyright, the repository, and where customer data sits — are questions before you sign a SaaS build. A questionnaire answered from a system you do not control is fan fiction. You are describing a machine someone else can change without telling you, and the buyer will hold you to the description.

There is a request in the pile you should decline outright. Some templates ask you to attach network diagrams, production credentials, or a full export of customer data "so we can review." A review that requires the keys is not a review. Offer a call in which you share a screen and read the setting aloud. A buyer who insists on credentials as a condition of the questionnaire has handed you a better security finding than any row in the sheet, and it is about them.

We are not the right firm for one version of this problem. We do not issue SOC 2 reports, we do not sign examination opinions, and we are not a substitute for the CPA firm or the counsel the company pile belongs to. An engineering partner can build the product controls the first pile asks about — authentication, deletion, logs, the account in your name — and can refuse to decorate the second pile. A partner who offers to "get you through the questionnaire" by rewriting nos into yeses is selling a document. AI security and compliance services on this site means the product controls and the evidence behind them, not a badge.

The shape of the product pile, when it has been treated as part of the product rather than as a packet at the end, is unremarkable on purpose. A multi-tenant agency operating system we built put subscription billing and role-based access for agencies, admins, and team members in the same workspace as the rest of the work, because an assistant and a permission model that do not know about each other will fail the first serious question a customer asks. That is a description of scope, not a headcount and not a duration. Your questionnaire does not need that whole system. It needs the rows you claim to be true to be openable on a screen.

If the sheet arrived before you have a single customer, you are early, and the correct move is to answer only what is already true and to spend the week on the product pile rather than on insurance quotes. A two-week AI readiness assessment maps a system you already have; it does not manufacture a company control you can paste into row 40. A startup software development company is the right conversation when the product pile has gaps you want built — deletion that actually deletes, logs you can open, an account that is yours — and the wrong conversation when what you want is someone to sign a report.

Reply to the buyer with the two piles visible, not with a wall of yes. Product rows: the object, the account, the setting. Company rows: not in place, unless you can link the document. Outcomes you have not met: say so, in the spirit of a framework that already told you it is not a checklist of actions. Then stop editing. A questionnaire that survives contact with the console is the one a second buyer can receive without a rewrite, and a second buyer is the entire reason the first one asked.