How do you keep a security questionnaire from stalling a B2B deal?

A security review stalls when the vendor waits to be asked. Send the answers before the questionnaire arrives.

Here is the pattern I keep seeing at early B2B companies. The buyer likes the product. The business case is agreed. Then someone on their side forwards a long spreadsheet of security questions, and the deal goes quiet for weeks. The founder treats it as paperwork. The buyer treats it as the moment they decide whether you are a risk they can explain to their boss.

The questionnaire is part of the sale. Run it like one.

Why do security questionnaires stall deals?

Three reasons, and only one of them is about security.

1. Nobody owns it. The rep forwards it to engineering. Engineering has a sprint. The spreadsheet sits in a shared folder with half the rows blank.
2. It arrives as a surprise. Nobody asked early who reviews vendors on the buyer's side or what they require. So the review starts late and runs on their schedule.
3. The answers are vague. "Industry-standard security" in a free-text cell tells the reviewer nothing they can approve.

The controls themselves are often fine. The process around them is what breaks the timeline.

What should be in a security packet?

Everything a reviewer asks for in the first round, ready to send as one link.

• A trust or security page that explains how you handle data, where it is hosted, and who to contact with questions.
• Your audit status. If you have a SOC 2 report or an ISO 27001 certificate, say how to request it under NDA. If an audit is in progress, say which stage it is in. Never imply a report you do not have.
• A completed standard questionnaire. Many reviewers accept a pre-filled industry format such as the SIG questionnaire from Shared Assessments or the CAIQ from the Cloud Security Alliance. Filling one out once means you stop starting from zero on every deal.
• A data flow summary. What customer data you touch, where it goes, and which subprocessors see it.
• Your policies. Access control, incident response, and data retention, written in plain language.

Most of it already exists in someone's head. The work is putting it in one place a stranger can read.

When should I send it?

Before they ask. The moment the deal looks real.

Ask on an early call who reviews new vendors and what they need. Then put the security review into the mutual action plan as a dated step with a named person on their side. A security step with no owner and no date is how a close planned for next week turns into next quarter.

It is also a forecasting question. If you do not know whether a review is required, you do not know when the deal can close. That is the whole point of timeline-qualified pipeline. Mark the review on the opportunity instead of guessing.

How do I answer questions where I have a gap?

Honestly, with a plan.

Every early company has gaps. No third-party penetration test yet. No SSO. A policy that exists in practice but not on paper. Reviewers expect some gaps. What they cannot accept is finding out later that an answer was stretched.

For each gap, write three things: what is true today, what you do instead, and when that changes. "No third-party penetration test yet. Internal testing on every release. External test scheduled for next quarter." A reviewer can approve that with conditions. A blank cell or a claim they cannot verify gets escalated.

The rule from objection handling on a sales page applies here too. Answer the real fear in plain words before it becomes a reason to wait.

Who should own the review?

One person, named, with time blocked to do it.

At a small company that is usually the founder or the most senior engineer. The salesperson keeps the timeline and the relationship. The owner writes the answers and joins a call with the buyer's reviewer when needed. I have seen one short call with a security lead clear more open questions than a week of email.

Keep every completed questionnaire in a shared library. Reuse answers. After a few deals, most new questionnaires become copy, check, and update.

What should I do this week?

1. Build the security packet: trust page, audit status, one completed standard questionnaire, data flow summary, and policies.
2. Add "who reviews new vendors, and what do they require?" to your early discovery questions.
3. Add a dated security step to every open deal plan where a review is likely.
4. Name one owner for questionnaires and give them the answer library.
5. Write your gap list with the honest current state and a date for each item.

Adapt or fail. The buyer is deciding whether you are safe to bet on. Make that decision easy.

Start Signals, Convert, Grow

FAQ

Do I need SOC 2 before selling to mid-market companies?

Not always. Many buyers will work with an in-progress audit if the dates are clear and the rest of the answers are solid. Ask early whether a report is a hard requirement for that buyer so you do not find out at the end.

What is the SIG questionnaire?

The Standardized Information Gathering questionnaire from Shared Assessments is a widely used vendor risk questionnaire. Some reviewers accept a completed SIG in place of their own spreadsheet.

Should sales fill out the questionnaire?

No. Sales should run the timeline. Someone who knows the systems should write the answers, because a wrong answer can come back later as a contract term.

How long should a security review take?

It depends on the buyer's process, which is exactly why you ask early and put the date in the deal plan instead of guessing.