← All guides

Answering a security questionnaire without losing three weeks

Large enterprises do not sign without checking their suppliers. Their security questionnaire often arrives late in the sales cycle, with a short deadline. Here is how to handle it without tying up your engineering team.

1. Sort the questions before answering

Put each question into one of three groups: what can be checked in your systems (encryption, backups, logs), what depends on a document (policy, procedure, contract), and what does not apply to you. Sorting takes an hour and keeps developers away from organisational questions.

2. Answer with evidence, not intentions

“Yes, our data is encrypted” is worth nothing without proof. For every “yes”, note where the certainty comes from: a configuration export, a scan report, a dated screenshot. If you cannot find the proof, the honest answer is “partially” or “in progress”.

3. Say what is not compliant

An experienced buyer distrusts a questionnaire with no “no” at all. A weak point with a dated plan reassures more than an unverifiable “yes”, and protects you if an audit follows.

4. Have the person who signs review it

These answers commit the company and often end up attached to the contract. A review by an executive or a lawyer avoids promising a notification delay or a service level you cannot meet.

5. Keep everything for next time

Questionnaires look alike. Keep each answer with its evidence and its date. The second questionnaire then takes far less time, provided you re-check the evidence: an answer that was true six months ago may not be today.

Where Hadovia helps

Hadovia automates steps 2 and 5: it checks your systems read-only, attaches the evidence to each answer and re-checks it for every new questionnaire.