Can a small vendor pass an enterprise security review without SOC 2?

Often, yes. Most mid-size buyers accept a consistent, honest self-attestation — a security policy, data-handling statement, incident-response summary, and complete questionnaire answers — especially for lower-risk data categories. What fails reviews is inconsistency and bluffing, not the absence of a certification.

What documents should a small vendor have ready?

An information security policy, a data handling and retention statement, an incident response summary, a subprocessor register, and an access control statement. With those five, most questionnaire answers write themselves.

What happens if I answer "no" to a security question?

A "no" with a compensating control and a dated roadmap item reads far better than a suspicious "yes." Reviewers score consistency and self-awareness; a documented gap list signals maturity, not weakness.

Back to blog home

vendor · 2026-08-25 · published

How To Answer An Enterprise Security Questionnaire When You Have Nothing Prepared

The deal is going well. Then procurement sends the spreadsheet: 200 questions about encryption, access control, incident response, business continuity, and vendor management. They'd also like your Information Security Policy. You don't have one. The deal closes in three weeks.

This happens to almost every small vendor exactly once — the first time they sell to a company big enough to have a security team. Here's how to get through it without a $20,000 audit and without torching your credibility.

What the reviewer is actually looking for

Enterprise security reviewers are not expecting a five-person vendor to look like a bank. They're checking three things:

1. Consistency. Do your answers agree with each other, with your website, and with your contract? Inconsistency is the #1 red flag — it suggests you're answering aspirationally rather than factually. 2. Self-awareness. Do you know where your gaps are? A vendor with a documented gap list is managing risk. A vendor with 200 "yes" answers and no evidence is hiding it. 3. Blast radius. What data of theirs do you touch, and what happens if you're breached? Most of the questionnaire is really asking this one question from forty angles.

The five documents that answer 80% of any questionnaire

Information Security Policy — scope, roles, access control, device policy, change management, review cadence. For a small team this is 6-10 honest pages, not a binder.
Data Handling & Retention Statement — what categories you collect, where they live, how long you keep them, how deletion works.
Incident Response Summary — severity levels, who gets notified, in what window. Enterprises mostly want to see a customer-notification commitment (72 hours is the common bar).
Subprocessor Register — every third party that touches customer data, what it's for, and a link to their DPA. Your hosting provider, email provider, analytics, and payment processor are all on this list.
Access Control Statement — how accounts are provisioned and removed, MFA status, admin access limits.

With those five in hand, most of the 200 questions become copy-paste with light editing.

How to answer the questions you have to say "no" to

Never bluff. Reviewers have read ten thousand questionnaires; invented answers have a texture they can smell. The formula that works:

> "Not currently. {Compensating control today}. {Practice} is scheduled on our security roadmap for {quarter}."

Example: "We do not currently run a formal vulnerability scanning program. All infrastructure is managed by {cloud provider} with automatic patching, dependencies are updated via automated PRs, and a scheduled scanning tool is on our roadmap for next quarter."

That answer scores better than a bare "yes" would, because it's checkable and it demonstrates the thing the reviewer actually cares about: you know your own posture.

Self-attestation is a real posture — label it as one

You don't need to pretend to be certified. A clearly-labelled self-attestation — "these documents describe what we actually do, declared by us, not audited by a third party" — is an accepted answer for most mid-market procurement, particularly where the data you touch is low-sensitivity. The label protects you legally and reads as candour. What you must never do is imply third-party assurance you don't have; that's the answer that gets vendors ejected from procurement pipelines permanently.

Do it yourself, or get attested in 24 hours

Everything above is doable in a focused week: write the five documents, build your answer bank, keep them consistent.

If the deal can't wait a week, start with the five documents above, write every answer from what you actually run, label it honestly as self-attestation, and keep a prioritised list of the gaps you still need to close. Procurement teams reward a clear, honest answer far more than a polished one that falls apart on the first follow-up question.

Either way: answer honestly, keep it consistent, and hand them a gap list before they find the gaps themselves. That's the whole game.