You landed the demo. The enterprise prospect loved it. Then their procurement team sent over a questionnaire. Two hundred questions, organized into sections like “Access Management,” “Incident Response,” “Third-Party Risk Management,” and “Data Classification.” Half the questions reference frameworks you’ve never implemented. The deadline is two weeks.

You have no CISO. Your team built fast. And right now you’re trying to figure out whether this deal is still alive.

I’ve been on both sides of this table — I’ve helped companies build the security programs that pass these audits, and I’ve been the person on the enterprise side reviewing the answers. Here’s what you actually need to know.

What These Questionnaires Are Really Measuring

Enterprise procurement teams are not trying to catch you. They’re trying to demonstrate due diligence to their own legal and security teams. The person who sent you that questionnaire did not write it — it’s usually a template from a tool like Prevalent, OneTrust, or a custom version of the SIG (Standardized Information Gathering) questionnaire.

What they’re actually looking for: Do you take security seriously? Do you have documented practices? Do you know where your data lives? And critically — do you have someone at your company who can own the security relationship with them?

A small company with documented policies, genuine practices, and an honest answer to hard questions will almost always beat a larger company with vague, boilerplate answers and no real ownership.

The Questions That Are Actually Blockers

Not all 200 questions carry equal weight. Enterprise security teams have learned to focus. The actual blockers vary by industry, but they almost always include:

Data handling. Where does customer data live, who has access to it, and how is it encrypted in transit and at rest? If you can answer these specifically, you’re ahead of most companies your size.

Access control. Do you use multi-factor authentication for systems that touch customer data? Do you have a documented process for revoking access when someone leaves the company? These are table-stakes questions now. If the answer is no, fix it before you answer.

Incident response. Do you have a documented incident response plan? Have you had a security incident in the past 12 months, and if so, how was it handled? You can answer “our incident response plan is being formalized” — that’s honest. You cannot answer “yes, we have a plan” and not have one, because they may ask to see it.

Penetration testing. Have you done a third-party pen test in the past 12 months? For most mid-market enterprise deals, this is a high-weight question. If you haven’t, you need to either schedule one or be prepared to explain your compensating controls.

Subprocessors. Who else handles customer data on your behalf? Your AWS/GCP/Azure infrastructure, your third-party analytics tools, your support platform. Enterprise procurement teams are increasingly focused on your vendor security, not just your own.

What You Can Do in Two Weeks

You cannot build a mature security program in two weeks. You can get organized, close the obvious gaps, and put yourself in position to have an honest conversation.

In two weeks, you can:

  • Document your access control practices. Even if they’re informal, writing them down and making them a policy takes hours, not weeks.
  • Enable MFA everywhere it isn’t already enabled. This is a two-hour project with immediate questionnaire impact.
  • Inventory where customer data actually lives. Databases, backups, third-party tools. You need to know this list to answer the data handling questions.
  • Identify your actual security gaps and write an honest remediation roadmap. Enterprise security teams are often more impressed by “here’s what we’re doing to improve” than by answers that feel suspiciously perfect.
  • Pull together any documentation you already have — your AWS security configuration, your deployment process, your offboarding checklist.

What You Should Not Do

Do not check “yes” on things you don’t actually do. Enterprise security teams do follow-up calls. If you say you have quarterly access reviews and you’ve never done one, you will be caught. The reputational damage from being caught lying on a security questionnaire is significantly worse than the deal risk from being honest about a gap.

Do not outsource the questionnaire to someone who doesn’t know your systems. I’ve seen companies send these to marketing consultants or junior staff who don’t know the answers. The result is a document full of confident-sounding answers that are completely wrong about your actual environment.

Do not assume you have to answer every question the way it was asked. You can write “not applicable to our architecture” with an explanation. You can offer compensating controls. You can say “our current practice is X — here’s our roadmap to Y.” The narrative matters.

The Call That Comes After

Most enterprise procurement processes include a security review call after the questionnaire. This is actually good news — it means someone is reading your answers and wants to understand your environment, not just mark a box.

On that call, the person asking you questions is trying to assess whether they can put your company name in front of their CISO and defend the decision. Give them the language to do that. Be specific. Know your architecture. Know who owns security at your company. Have a name to put on the security contact field.

If you’re staring at a questionnaire right now and trying to figure out which gaps are deal-killers versus which ones are fine to be honest about, that’s exactly what a 15-minute call would cover. I’ve reviewed these from both sides. Book time at go.nebari.cc/15-min and we can walk through your specific questionnaire, identify what you need to close, and figure out whether this deal is worth the security investment it’s going to require.

Related: Do I Need SOC 2? | Security Compliance Without a CISO | Compliance vs. Security: What’s the Difference?