The 300-row security questionnaire

The SOC 2 piece mapped the report every enterprise buyer eventually demands. That report is one gate. This is the other — and it tends to land in the same week, from the same deal: a spreadsheet. Two, three, sometimes four hundred rows. Every row a yes/no/explain about how a company runs its systems. This is the security questionnaire, and it's the most reliably underestimated piece of enterprise engineering work there is.

These land under deal pressure — the sales team forwarding it Thursday afternoon with "the customer needs this back by Friday to sign" in the subject line. The first time, it eats a week. The tenth time — if nothing changed in between — it still eats a week, and that's the tell that something's broken in how it's being handled.

The reframe that makes it tractable: the questionnaire isn't a security test to pass or fail. It's risk transfer. The buyer's security team is moving liability off their desk and onto the vendor's written answers — so that if the vendor is breached, the paper trail says the vendor attested to the control that failed. Understand that and two things follow: the answers get written more carefully, and the team builds the thing that makes it stop hurting.

They come in three shapes. Two are standardized: the SIG (Standardized Information Gathering, from Shared Assessments) and the CAIQ (Consensus Assessments Initiative Questionnaire, from the Cloud Security Alliance). The third is the one that actually shows up most: a bespoke spreadsheet the buyer's security team built themselves, that no two companies fill out the same way, and that reinvents the standardized ones one reworded row at a time.

Whatever the shape, the sections rhyme — and alongside the SOC 2 piece, they rhyme with something else too:

That overlap is the whole opportunity — §03 gets to it. Hold onto it.

Sales owns the deal and legal owns the contract, but the questionnaire's answers live in exactly one place: an engineer's head. Nobody else can truthfully say how key rotation works, whether the staging database has real customer data in it, or what actually happens to a backup after ninety days. So it routes to engineering — usually mid-sprint, usually with a deadline set by when the customer wants to sign, not by anything on the board.

That would be survivable if it happened once. It doesn't. Every deal brings a new variant of the same 300 questions, reworded, reordered, in a different spreadsheet. Without a source of truth the team re-answers from scratch each time — and here's the quiet danger — the answers come out inconsistently. Deal A's questionnaire says data is retained 90 days; deal B's, answered by a different engineer in a different sprint, says 180. Now two enterprise customers hold contradictory written attestations from the same vendor about the same system. That's not just annoying; it's the kind of drift a real audit or a breach investigation lights up.

The cost isn't the first questionnaire. It's that the hundredth one still costs a week — because the answers were never written down anywhere but in the head of whoever happened to be free that Thursday.

Here's where the report from episode 1 pays a second dividend. A large fraction of every questionnaire is really one question asked three hundred ways: "is this control in place?" And for anything inside SOC 2 scope, the answer collapses to a single move — "Yes. See the relevant section of our SOC 2 Type II report, attached under NDA."

This is the argument for SOC 2 that the logo-on-the-wall framing misses. The report isn't only the thing that gets a deal past the vendor-risk gate — it's the thing that turns the questionnaire behind it from a week of writing into an afternoon of citing. Policies pick up the next chunk ("per our documented access-control policy"). What's left — the genuinely bespoke rows about the vendor's own architecture — is the only part that needs a human, and it's small.

The fix is the same instinct as the SOC 2 piece: stop treating each questionnaire as fresh work, and build the system that answers it as a byproduct of being answered once. Two artifacts do almost all of it.

The first is a canonical answer bank — every question the company has ever been asked, answered once, each answer owned by a named person, dated, and linked to its evidence (the report section, the policy, the config). A new questionnaire becomes a matching problem, not a writing problem: map incoming rows to answers already trusted, and surface only the genuinely new ones for a human. The consistency risk from §02 disappears, because there's now exactly one place the answer to "how long do we retain data" lives.

The second is a public trust center — a page that pre-publishes the certifications, subprocessor list, DPA, and a pen-test summary, and lets a prospect self-serve the report request under NDA. The best security teams check it before they send the spreadsheet, and a good trust center deflects a chunk of questionnaires entirely. Tools like SafeBase and Whistic productize this, and the SOC 2 platforms from episode 1 — Vanta, Drata — now ship trust centers too. (Same caveat as always on this blog: paid tools, worth it when the questionnaire volume justifies it — not before.)

At a company doing more than a handful of enterprise deals a year, four pieces earn their place — and notice they're the same shape as the SOC 2 build: make the system emit the answer, don't re-derive it under deadline.

01

A canonical answer bank

Every question answered once, owned by a name, dated, and linked to evidence. Reviewed on a cadence so answers don't quietly go stale. This is the single highest-leverage artifact — build it before buying anything.

02

A SOC 2 → questionnaire crosswalk

A mapping from the common question families to the exact report section that answers them. Turns "is X in place" rows into one-click citations and keeps the pointing consistent across deals.

03

A public trust center

Certs, subprocessors, DPA, pen-test summary, NDA-gated report request. Deflects the easy questionnaires before they're ever sent and signals maturity to the buyer's security team.

04

A "diff the questionnaire" step

Match each incoming row against the answer bank; auto-fill the confident matches, and route only the genuinely novel rows to an engineer. The week collapses to the handful of questions that are actually new.

SOC 2 gets a deal to the gate. The questionnaire is the turnstile behind it. Answer it once, point at the evidence, and both stop being a tax on every deal.

This is mapped from the engineering side, not from a security team's side of the table — not from being the one deciding which vendor's answers were good enough to sign. If that's the reader's seat, corrections welcome: which rows actually move a decision, where a slick trust center reads as a red flag rather than a green one, what a lazy answer looks like from that side of the table.

Email or X. Building in the open is partly a learning project; the outside input is the point.

— Neil