A customer sent a security questionnaire. Answer it with evidence.

Does this sound like your week?

• The deal is real, the spreadsheet is hundreds of rows long, and nobody here owns security.
• We did not get through the review, and the buyer asked us to come back when the gaps are closed.
• The investor's due diligence list asks for policies and logs we do not have yet.
• We do not know which answers we are allowed to give as planned.
• Someone said get SOC 2. We are not sure that is what the buyer needs.

A questionnaire is a list of ordinary engineering controls asked as questions: who has access, what is logged, how changes ship, how data is backed up. Two common standard formats are the SIG from Shared Assessments and the CAIQ from the Cloud Security Alliance, both public, so the work is knowable in advance.

What we do in the first two weeks

1. Days 1 to 2

   Sort every question into three piles

   Already true and provable, true but with no evidence yet, and not true yet. You get the sorted list with the rows that matter most to this buyer marked. Nothing is answered yes unless it is.

2. Days 3 to 7

   Fix what is quick and matters most

   Typical first fixes are access (single sign-on, multi-factor, unused keys and accounts removed), audit logging switched on and retained, a backup restored once to prove it works, and secrets moved out of code. Each change is made in your accounts, through code where possible, with your engineers in the loop.

3. Days 8 to 11

   Build the evidence pack

   Configuration exports, screenshots, policies that describe what your team really does, and a short architecture note. It lives in your repository, so the next questionnaire starts from it.

4. Days 12 to 14

   Answer, with a dated plan for the rest

   We draft the responses with you. For gaps that take longer, the answer is a dated remediation plan, which a reviewer can assess in a way they cannot assess a vague yes.

Two weeks covers the sorting, the first fixes and a first set of answers. Some controls take longer, and a SOC 2 Type 2 report covers a period of operation by definition. SOC 2 Type 1 vs Type 2 explains which one to pursue first.

What is in scope

• Customer and vendor security questionnaires: SIG, CAIQ, or the buyer's own spreadsheet
• Investor technical and security due diligence lists
• The cloud controls behind the answers on AWS, GCP and Azure: identity and access, logging, network exposure, encryption, backups, secrets, CI/CD
• Policies written to match what your team really does
• Technical readiness for SOC 2, ISO 27001 and DPDP: we build the controls and produce the evidence
• Cloud cost and stability reviewed in the same pass, since tagging, access control and logging serve all three

For how to work a questionnaire as a small team, read the security questionnaire gauntlet. If the reviewer asked for an audit of your cloud itself, what a cloud security audit checks sets out the six areas and what the report must contain.

What this is not

• Not a certificate. A SOC 2 report is issued by a licensed CPA firm (CSA explainer) and an ISO 27001 certificate by a certification body. We prepare you; they attest.
• Not a promise that you pass. The buyer decides. What we control is that every answer is true and has evidence behind it.
• Not answers written to look good. We will not mark a control as in place when it is not.
• Not legal advice. Contract clauses and privacy law questions go to your lawyer.
• Not a penetration test by default. If the buyer requires one, it is a separate fixed-scope piece of work on the pricing page.