Winning a first enterprise client is a milestone. It also introduces a stage of the sales process that never appeared in any earlier deal: the security questionnaire. When a large organization considers handing over its data, its procurement or security function wants to know where that data will sit, who can reach it, how it is separated from everyone else’s, and what happens when something breaks. The questions come from a buyer discharging a duty to its own auditors, and in enterprise sales they arrive eventually. For a business that has grown on the quality of its product and its service, they can still land in unfamiliar territory.
The useful thing to understand early is that answering them well is mostly a documentation exercise. Infrastructure decisions taken years ago for reasons of cost or convenience become sales answers, and the business that can state them plainly moves faster than the business that has to go and find out.
Key Takeaways
|
Late in the deal a spreadsheet lands
The questionnaire rarely arrives early. Demonstrations have gone well, the buyer is enthusiastic, commercial terms are close, and then procurement forwards a document with a list of security questions and a deadline attached. The deal does not die at that point. It stalls, which for a growing business carrying a forecast is close enough to the same thing.
The specific document varies. Some buyers send their own, assembled from internal policy. Others use a standard instrument, and the most widely recognized one in cloud services is the Cloud Security Alliance’s Consensus Assessments Initiative Questionnaire.
CSA describes CAIQ as a downloadable spreadsheet of yes or no questions mapped to the controls in its Cloud Controls Matrix. Version four runs to 261 questions, with a shortened CAIQ-Lite at 124.
Those figures reveal what kind of document it is. A 261-question spreadsheet is not an examination anyone crams for in a week, and it was never designed to be. It is a request for information the vendor is assumed to hold already. Underneath the variation in wording, the concerns cluster into five: location, access, isolation, recovery, and the evidence supporting each of the other four.
From technical detail to a commercial answer
Treating the questionnaire as an IT ticket is the common error. It is a commercial document, and it should be answered by someone who can speak for the business as well as for the software. Three areas carry most of the weight.
Where the data actually sits
The baseline is knowing which country or region the primary systems run in, which hosting provider operates them, what categories of customer information are stored, and where the backups live. Third parties count too. Most businesses of any size rely on several external services for payments, email, analytics or support, which is ordinary, and each one becomes a line on the spreadsheet.
The FTC’s data security guidance for business reduces the whole lifecycle to a single instruction: collect only what you need, keep it safe, and dispose of it securely. Its companion guide, Start with Security, draws ten lessons from more than fifty of the agency’s own data security settlements, which makes it a more useful reading list than most vendor material, because every lesson was paid for by a company that got it wrong.
Isolation on shared and unshared hardware
Shared cloud infrastructure is a sound choice for most businesses, and the honest answer to an isolation question on shared infrastructure is a description of the controls: hypervisor separation, identity and access management, network segmentation, and the provider’s own attestations covering the layers a customer cannot inspect.
Some buyers press further, particularly where their own regulator has views about tenancy, and want to know whether the physical machine is shared. There the answer gets shorter. Provider documentation states it directly, and the specification for an OVHcloud dedicated server sets out that every hardware resource on the machine is allocated exclusively to one customer, with no virtualization layer sitting between the operating system and the hardware.
Being able to point at that is convenient in a questionnaire, and it accomplishes very little on its own. A single-tenant machine that is unpatched, over-permissioned and unmonitored is a worse answer than a well-run shared environment, and any competent security reviewer will say so. What the hardware buys is one sentence in the architecture becoming verifiable rather than descriptive.
The restore nobody has tested
Backup questions go deeper than most businesses expect. Frequency, storage location, retention period, who holds access to the backups themselves, and how a restore is actually performed. The last of those is where readiness usually fails, because a backup that has never been restored is a hypothesis.
NIST’s guidance for small businesses puts it in two sentences: regularly back up your data, and establish measures to protect and test those backups. The testing half is the half that gets skipped. Three scenarios are worth having written answers to well before anyone asks for them: a corrupted production database, customer records deleted in error, and the primary environment unavailable for a full working day.
The one page a sales team can hand over
All of this collapses into a single document, and the value of the exercise is that the document exists before it is needed. A data fact sheet covers the hosting provider, country and environment, the categories of customer information held, who can reach production systems and how that access is granted and revoked, and how customers and workloads are separated from one another.
It then covers how data is encrypted in transit and at rest, backup frequency and location and retention and restore procedure, recovery objectives and incident handling, logging and alerting and monitoring, the significant third parties in the chain, and whatever policies, audits or independent assessments already exist.
Most businesses discover two things while assembling it. Some areas need genuine work. Others were already handled competently and had simply never been written down anywhere a salesperson could reach. The second discovery is the more common of the two, and it is the cheaper problem to have. Small business coaching for small businesses can help owners recognize when winning bigger clients requires more than a good product—it also requires stronger processes, clearer ownership, and better documentation.
Whether certification is the right first step
A buyer who names SOC 2 or ISO 27001 may be describing a preference, and the two are frequently discussed as though they were one kind of object. They are two. SOC 2 is an attestation, in which a CPA examines controls against the trust services criteria of security, availability, processing integrity, confidentiality and privacy, then issues a report.
There is no SOC 2 certificate. ISO/IEC 27001, currently in its 2022 edition, specifies requirements for an information security management system and is certifiable by an accredited body.
The distinction has a practical consequence. A report is a document a buyer reads, and a certificate is a status a buyer checks. Knowing which one a customer wants keeps a business from committing months of work and a significant fee to the wrong instrument. CSA’s STAR registry offers a third route, a public register documenting the security and privacy controls of cloud offerings, which for some buyers answers the question on its own.
Both sit downstream of answering a questionnaire honestly. Where certification is expected in a target market it becomes a commercial requirement and belongs in a plan with a date against it. Where it is not, documenting existing controls, tightening access management, fixing backup testing and writing readable policies delivers most of the same commercial benefit for a fraction of the outlay.
When dedicated hardware becomes the simpler answer to data questions
There comes a point in some businesses where controlled infrastructure is the easier thing to explain rather than the better thing to own. If isolation questions keep recurring, if a customer’s regulator takes an interest in tenancy, or if the operating environment needs configuration a managed platform will not permit, single-tenant hardware removes a category of question from the conversation.
That is all it removes. Encryption, access management, secure configuration, patching, monitoring and tested backups remain the business’s problem, and on dedicated hardware rather more of them do. The gain is explicability. Procurement teams reward it, and it earns nothing on the technical side.
Readiness for data questions costs less than a lost deal
The work described here is cheap. Establishing where customer data lives, mapping who can reach it, testing a restore, listing the suppliers and writing the fact sheet amounts to a few days of one person’s attention, spread across a quarter if that is what the calendar allows. NIST’s small business guidance frames cyber threats as a business risk and strong cybersecurity as a competitive advantage, which is the right register for a conversation happening inside a sales cycle.
The fact sheet takes an afternoon to assemble when nobody is waiting for it. It takes two weeks when a procurement team is, and those two weeks show up on the deal. The afternoon is available now.
Disclosure: this article was produced as part of a sponsored placement. The technical claims are sourced to the primary literature linked above.
Frequently Asked Questions
1. Why do enterprise clients send security questionnaires to vendors?
Enterprise clients use security questionnaires to understand where their data is stored, who can access it, how it is separated from other customers’ data, and what happens when something goes wrong. These questionnaires help procurement and security teams evaluate a vendor’s controls and meet their own audit responsibilities.
2. What information should a business prepare before answering a security questionnaire?
A business should document its hosting provider and location, customer data categories, production access controls, data isolation, encryption, backups, restore procedures, recovery objectives, incident handling, monitoring, third-party services, and existing security policies or assessments. Keeping this information in a data fact sheet can make it easier for the sales team to respond when enterprise buyers ask security questions.
3. What is the difference between SOC 2 and ISO 27001?
SOC 2 is an attestation in which a CPA examines controls against trust services criteria and issues a report. ISO/IEC 27001 specifies requirements for an information security management system and can be certified by an accredited body. Understanding the difference helps a business determine which one an enterprise customer actually requires.
