Passing an Enterprise Security Questionnaire as a Startup

What a vendor security questionnaire asks

Enterprises use their own spreadsheets or standard ones. A common standard is the Cloud Security Alliance's CAIQ, whose version 4 has 261 questions across 17 domains, with a shorter "Lite" version aimed at SMEs and startups. Whatever the format, the same themes come up.

How to answer honestly without losing the deal

The answers often end up attached to the contract. A "yes" you cannot back up becomes a misrepresentation if something goes wrong later. Buyers expect startups to have gaps; what they look for is that you know about them and have a plan.

1. 1

   Read the whole questionnaire before answering

   Mark each question as yes, partly, no or not applicable. Group the "no" answers; most cluster around a few missing controls.

2. 2

   Fix quick wins first

   Enforcing MFA for everyone, turning on disk encryption, and removing old admin accounts often take days, not months, and turn several "no" answers into "yes".

3. 3

   Write answers with scope and evidence

   Say what is covered. "MFA enforced for all staff on Google Workspace and AWS since March; report attached" beats a bare "Yes".

4. 4

   Use "partially" or "planned" with a date

   "Formal incident response plan in draft, to be approved by 30 November" is an honest answer that most reviewers accept for a small vendor.

5. 5

   Mark not-applicable questions clearly

   A three-person startup with no office does not run CCTV. Explain why it does not apply rather than leaving it blank.

6. 6

   Keep a master answer file

   Save every answer and its evidence. The next questionnaire will repeat many of the same questions in different words.

Cyber Essentials, Cyber Trust, ISO 27001 or SOC 2?

A recognised certification answers many questions at once, and some buyers will accept it in place of parts of their questionnaire. Which one depends on who you sell to.

Sources: CSA's Cyber Essentials and Cyber Trust pages, ISO/IEC 27001 and the AICPA SOC suite. Our ISO 27001 vs Cyber Trust guide compares the effort in detail.

Ask the buyer early which certifications they accept. Many Singapore enterprises are happy with a Cyber Essentials mark plus a completed questionnaire for a smaller contract. A SOC 2 Type 2 report covers a period of operation, usually months, so it cannot be produced in time for a deal closing next quarter.

MFA, SSO and admin evidence buyers ask for

Identity questions carry the most weight, because stolen logins are behind many breaches. Have screenshots or exported reports ready for these:

• MFA enforced for every user, not just available. Microsoft Entra and the Google Admin console both report enrolment per user.
• Admin accounts kept separate and few, with phishing-resistant MFA such as passkeys or security keys where possible.
• Single sign-on (SSO) into your product for enterprise customers, if you sell software. Many buyers ask for SAML or OIDC so they can control their staff's access.
• Leaver process showing accounts are disabled on the last day.
• Device controls: disk encryption, screen lock and up-to-date operating systems on every laptop that touches customer data.

Our Microsoft 365 security checklist lists the settings that produce this evidence in an afternoon.

PDPA: data protection clauses in enterprise contracts

If your startup stores or processes personal data for a client, such as their customers or staff, you are usually its data intermediary under the PDPA. The client remains responsible for that data and will pass protection and retention duties to you by contract. Expect clauses on security arrangements, breach notification to the client, deletion at the end of the contract, subprocessors and overseas transfers.

PDPC's guide to data protection practices for ICT systems sets out basic and enhanced practices that many Singapore buyers use as a reference when writing these clauses. Before you sign:

Our guide to data processor agreements under the PDPA explains these clauses from the buyer's side, which helps you predict what will be asked.

Building a reusable security pack

Startups that sell to enterprises regularly keep a small security pack they can send before the questionnaire arrives. It shortens review and shows maturity.

• One-page security overview: hosting, encryption, MFA, backups, incident contact
• Information security policy and acceptable use policy (short and actually followed)
• Incident response plan with notification timings
• List of subprocessors with their certifications
• Certification certificate, such as Cyber Essentials, and expiry date
• Latest penetration test summary, if you sell software
• Master questionnaire answer file

For budgeting the controls behind these documents, see our guide to cybersecurity costs for small businesses.

Do it yourself or get help?

A technical founder can usually answer a questionnaire in a few days if MFA, device encryption and backups are already in place. The time goes into writing policies and collecting evidence the first time.

If a deal is waiting on you, a Security Health Check (S$290) gives a ranked list of gaps against what buyers ask. Our Microsoft 365 / Google Security Lockdown (S$590) closes the identity and admin gaps with exportable evidence. For a mark you can name in the questionnaire, CSA Cyber Essentials Readiness (from S$990) prepares the policies, asset list and evidence pack, and the Cyber Essentials checklist shows what the assessor checks.