Every team I know that sells upmarket has the same story. An enterprise procurement team sends a security questionnaire — 150, 200, sometimes 300 questions about MFA, SSO, encryption, backups, incident response, subprocessors. The founder opens the spreadsheet, sighs, and starts typing from memory. Three days later the answers go out, three different people having written near-identical rows three different ways, and the buyer's reviewer flags the one thing that matters: the answers don't agree with each other.
Here is the reframe that fixes it: the questionnaire is not a test of your security. It is a test of whether you can show your security, on paper, in the time the buyer allows.
The fix is not a faster typist. It is an answer bank — and every enterprise vendor you compete against already maintains one. The small-team sin isn't having one; it's paying the full answering price, per buyer, forever.
What the bank looks like
One sheet, about 40 rows, five columns:
- Normalized question — "How do you handle MFA?" collapses the eleven phrasings of the same question.
- The answer — 2–4 sentences, written once, carefully.
- Evidence artifact — a link to the thing that proves it: the SSO console, the restore-test record, the provider's SOC 2 letter, the vendor review notes.
- Last-verified date.
- Owner.
Group the rows by the eight themes every questionnaire is built from: access control and SSO, MFA, encryption, backups, incident response, vendors and subprocessors, people, physical/data center. For a cloud-hosted team, the physical section is literally one row: "we run on [provider], their SOC 2 covers it" — with the report attached.
Forty rows covers 85–90% of a typical 240-question review. That is not a coincidence; it's how procurement builds these things.
Ground truth, not memory
Two rules keep the bank honest:
- Every answer cites an artifact that exists today. If the evidence doesn't exist, the answer is "Not yet — current state is X, and we close it on date Y." Buyers flag evasiveness and inconsistency. A credible, dated "not yet" reads as maturity, not weakness.
- Nothing answers a buyer after 90 days unverified. A quarterly one-hour pass walks the sheet, re-clicks each evidence link, updates dates. Stale answers are how a true answer becomes a false one without anyone lying — the SSO answer written in March testifying about the IdP you switched in July.
The two-hour workflow
- Answer by theme, not in order. The 240 rows arrive shuffled so they feel like 240 problems. They are ~40 problems wearing costumes. All access-control rows at once, straight from the bank. Then encryption. Then backups.
- ~85% pasted, ~15% written fresh — and every fresh answer gets folded back into the bank the same week. Each questionnaire should make the next one cheaper. One that doesn't was answered, not learned.
- One writer, one truth-checker. The writer keeps the voice uniform; the checker verifies each pasted answer against the evidence column before it leaves the building.
- Answer the control, not the topology. "Do you enforce MFA?" does not deserve your IdP's name, plan tier, and admin console URL. Assume every answer gets forwarded, screenshotted, and attached to a contract — because that's what happens to good answers.
The five traps
- The bank born perfect and never touched. The sheet that was beautiful in March answers March's posture in October. The last-verified column is the fix.
- The yes that was not true. "Yes" to MFA everywhere when the billing admin was never enrolled. This is the only answer that converts a form into a liability — when the incident comes, the buyer's counsel reads your answers as your position. Overclaim never, underclaim deliberately.
- Answering in order. Question 7 and question 181 are the same question wearing different syntax. Two fresh answers to one question is how drift is born inside a single document.
- Free internal disclosure. Volunteering internal tool names, versions, and hostnames in a spreadsheet. The NDA in the contract does not cover what you volunteered.
- The rotating cast of answerers. Three founders, three voices, three spellings of the product name. The buyer reads the document, not the org chart.
The worked example
A ten-person B2B SaaS. Every enterprise procurement sent a 150–240 question review; the founder wrote each from scratch over three days. One deal died on turnaround — procurement's ten-day window closed on day eleven. A second nearly did: two questionnaires, one answered by the founder, one by the CTO, described the backup story differently, and the buyer's reviewer flagged it as the most memorable line in the document.
The rerun: a 42-row bank built in one day, sourced from the last two questionnaires plus the evidence packet from their audit prep. The next 240-question review: two hours. 200 answers pasted, 40 written fresh and folded back within the week. The buyer's reviewer flagged nothing. Procurement's deal notes said "fast, consistent." The following quarter's questionnaire took one hour.
Nothing about their security had changed. What changed is that their security became legible on the buyer's clock — which is what the questionnaire was actually measuring.
The metrics that tell you it's working
- Bank coverage — share of a typical questionnaire answerable from the sheet (target ≥85%).
- Median hours from arrival to submission — days at first, hours at steady state; if it creeps back up, the bank went stale.
- Last-verified age — nothing unverified beyond 90 days.
- Drift count — zero. Same question, different answers in two forwardable documents is a defect with a name.
- Fold-back rate — every fresh answer added to the bank within a week. This is the metric that compounds.
The full version — the ~40-row sheet layout, the eight themes with what belongs in each, and the worked example — is free on the site: Security Questionnaire Answer Bank for Small Teams. If you'd rather answer the buyer's rows than write the sheet from a blank page, the Ops Starter Kit covers the incident-response answers, and Vol. 2 adds the communications half.
Top comments (0)