The document arrives late, usually after the commercial terms are agreed and everybody has started behaving as though the deal is done. It is a spreadsheet, it has somewhere between forty and three hundred rows, and the covering email says it should only take an hour.
It will not take an hour, and the reason is not the row count. The spreadsheet is not one document. It is four separate reviews stapled together by a procurement team, and each has a different author, a different standard of proof, and a different way of saying no.
Four reviewers, one file
The security engineer wants to know how the system is built and what happens when it breaks. The identity and IT team wants to know whether it fits the environment they already run, which is a question about protocols and administration rather than about risk. Privacy counsel wants to know what personal data you hold, where it travels and under what legal basis. Vendor risk wants a rating it can defend to an auditor, and will accept a documented gap far more readily than an empty cell.
Sorting the rows by author before answering anything is the single change that makes the work tractable. Questions that looked repetitive turn out to be four people circling the same control for different reasons, and each of them is satisfied by a different artefact.
- Security engineering: architecture, isolation, key handling, incident response, disclosure history
- Identity and IT: sign-on protocols, provisioning, session and password policy, administrative roles
- Privacy and legal: data categories, sub-processors, transfer mechanism, retention and deletion
- Vendor risk: certifications, continuity planning, insurance, and whether anyone owns the answers
Blocking rows and advisory rows
The rows do not carry equal weight, and treating them as though they do is how a week disappears. A small number of items stop a signature outright: no enterprise sign-on, no central way to remove a leaver, no encryption of data at rest, no commitment to notify on a breach. Everything else is scored, weighted, and argued about internally without you in the room.
For the rest, the useful move is a compensating control rather than a bare yes. If you have no formal access review calendar but every administrative action is logged, exportable and reviewed on a schedule, write precisely that. Reviewers are practised at reading around a gap. What they cannot process is a blank cell, or a claim that collapses under one follow-up question.
Reviewers can work around a documented gap. They cannot work around a blank cell, or a claim that collapses under one follow-up.
Evidence beats adjectives
An answer that says access is tightly controlled is worth nothing, because every vendor writes that sentence. An answer that says administrative actions are recorded in an append-only log, retained for a stated period, exportable by the customer in a documented schema, and here is the page describing it, ends the thread. The second answer is shorter to write, once the underlying thing exists.
That is what the questionnaire is really testing: whether your product emits evidence as a by-product of running. If producing proof requires an engineer to write a query, you will be slow every single time. If the customer can pull the audit trail themselves, several rows collapse into one link.
- Link to a stable page rather than pasting prose that will drift out of date
- Name the retention period and the export format instead of describing them qualitatively
- Where a certification is not yet held, state the position plainly and mark it (planned)
- Keep the completed response; the next questionnaire repeats most of it almost verbatim
Most of the delay is a calendar problem
Very little of the elapsed time in a security review is thinking time. It is waiting: for the one engineer who knows the answer, for legal to approve a sentence about sub-processors, for somebody to find last year's response in an inbox. Every handoff costs days and the deal sits still through all of them.
The remedy is unglamorous. Give each section a standing owner, keep the answers somewhere the sales team can read without asking permission, and review them on a fixed schedule so nobody has to verify a stale claim under deadline pressure. A review answered from a maintained source is a different sales motion from one answered from scratch, and the difference is organisational rather than technical.
Everything here, already built
Sign-in, enterprise SSO, directory provisioning, roles and an audit trail behind one API. Start with the quickstart and have a working sign-in this afternoon.