Enterprise readiness
The security questionnaire is now part of your sales process
If a large organisation is buying from you, someone in their risk function has a veto. Most smaller suppliers meet that person for the first time after the contract is agreed, which is the worst possible moment.
· 7 min read
There is a pattern we see repeatedly. A smaller business wins an enterprise client on merit: better product, better price, a champion internally who wants it. Commercial terms are agreed. Then a vendor onboarding pack arrives, a security questionnaire, a request for a data processing agreement, a demand for evidence of penetration testing and business continuity, and the deal enters a queue nobody owns.
Eleven weeks later the champion has moved teams, the budget has been reallocated, and the incumbent supplier has quietly renewed. Nothing about the product lost that deal.
Why this happens now and did not five years ago
Two things changed. Large organisations were made accountable for their supply chain, by regulators, by their own auditors, and by insurers who now ask pointed questions about third-party access. And enough high-profile breaches arrived through a small supplier that "we only give them read access to one system" stopped being a comfortable answer.
The practical result is that third-party risk assessment moved from a formality to a genuine gate, with a genuine reviewer who is measured on catching problems rather than on closing deals. Your commercial champion cannot overrule them, and often cannot even chase them.
What the reviewer is actually looking for
It is tempting to read a 250-line questionnaire as a demand that you become an enterprise. It is not. Most reviewers are looking for three things, and a small supplier can satisfy all of them:
- Are the basics genuinely in place? Multi-factor authentication everywhere, not just on email. Backups that have been test-restored. Access removed when people leave. Encryption in transit and at rest. These are not sophisticated controls and their absence is what actually ends assessments.
- Is someone accountable? A named owner for security, a documented incident response path, and a policy set that exists as more than an aspiration. The reviewer needs a person to escalate to, not a shared inbox.
- Are your answers truthful and consistent? This matters more than the answers themselves. A supplier who says "we do not currently have that, here is our plan and date" is far more credible and far more likely to pass than one whose claims fall apart under a follow-up question.
The most expensive mistake: overstating
Under time pressure, someone in the business fills in the questionnaire optimistically. The control is "basically" in place. It is on the roadmap. It applies to most systems. Every one of those becomes a written commitment.
A gap you disclosed is a negotiation. A gap they discover is a breach of contract.
Buyers re-test these answers, during onboarding, at annual review, and immediately after any incident anywhere in their supply chain. An overstatement found later does not just cost the account, it costs the reference, and it makes the next assessment harder because you are now a supplier with a history.
Build it once, use it on every deal
The businesses that clear these gates quickly are not more secure than their competitors by some large margin. They have simply done the work once, deliberately, instead of improvising it per deal. That work has four parts:
- An evidence pack. Architecture and data-flow summary, security overview, sub-processor list, backup and continuity position, insurance certificates, policy set. One folder, version-controlled, with a date on it.
- An answer library. The recurring questions with reviewed, approved answers and a named owner per control area. Update it when reality changes, not when a questionnaire arrives.
- A short remediation list. The handful of genuine gaps worth closing before the next assessment, almost always access control, logging, backup testing, and a written incident response plan.
- Someone who can hold the call. Reviewers move faster with a supplier who answers precisely, concedes gaps without defensiveness, and does not oversell.
For a business under 200 people this is typically two to four weeks of focused effort. It is reusable across every subsequent deal, and it is the difference between procurement being a three-week step and a three-month one.
Do you need ISO 27001?
Sometimes it is a hard contractual requirement and there is no way around it. Frequently it is not: many buyers will accept demonstrable controls plus a credible, dated roadmap, particularly from a supplier whose blast radius is small. Certification is a significant programme with real ongoing cost, and it is worth establishing which camp a specific deal falls into before committing to it.
The cheaper move, almost always, is to become a supplier who answers well.
