Security questionnaire

A security questionnaire is a set of questions a buyer sends to assess how a supplier protects data and systems, covering access control, encryption, incident response, certifications, and subprocessors. It usually arrives late in the deal and has to be answered before contracts can move.

Why it matters in B2B sales

Security review has become a standard gate rather than an exception, and it sits at the worst possible point in the cycle: after the buyer has chosen you, when everyone assumes the work is done. The deal is not lost here, but it is routinely delayed here, and a delay of three weeks at quarter end is a deal that closes in the next one.

The questions also go to the people least available to answer them. A security lead with an incident to handle will not drop it for a sales deadline, which is why the same questionnaire takes 2 days at one company and 5 weeks at another with identical controls. Cobl publishes its own answers to this category on the security page, which is the pattern buyers increasingly expect.

What a security questionnaire asks

Most follow a recognizable shape, whether custom or based on a standard framework such as SIG, CAIQ, or a vendor's own template. Access control and authentication. Encryption at rest and in transit. Data location, retention, and deletion. Incident response and breach notification timelines. Business continuity and disaster recovery. Subprocessors and their controls. Certifications, commonly SOC 2, ISO 27001, or sector-specific equivalents. Secure development practices and penetration testing cadence.

Regulated buyers add privacy sections tied to GDPR or sector rules, and increasingly ask how AI features handle customer data, which is the fastest-changing part of the category.

How to answer one faster

Keep the answers current in one place, with an owner and a review date on each. Most of the questions repeat across buyers even when the wording does not, so the constraint is not writing but retrieving something you can stand behind today. A content library works well here precisely because this content is genuinely repetitive.

Publish what you can before you are asked. A public trust page with certifications, subprocessor list, and architecture overview answers a meaningful share of most questionnaires and lets the buyer start their review before the questionnaire is returned. And answer honestly where a control is absent: state the compensating control and the roadmap. Security reviewers verify, and an overstated answer discovered later damages more than the gap would have.

A concrete example

A vendor selling to a hospital group receives a 180-question security questionnaire in week one of contracting. The security lead maps 140 questions to existing maintained answers in a day. Twenty need updating because a subprocessor changed. Twenty are new, covering clinical data handling, and take a week to answer properly with the compliance officer. Total elapsed time, nine days, against six weeks on the same buyer's questionnaire two years earlier.

How it shows up in day-to-day selling

Security answers should be written once and kept current. In practice they quietly rot. Certifications lapse, subprocessors change, and the answer file nobody owns keeps being reused. Cobl answers from your knowledge base, not from a copy found in a shared drive. When the questionnaire arrives on a deal, it drafts the answers from your current approved content. It flags the questions it could not answer, so your security lead only handles those.

The prize is not a faster answer for its own sake. It is that a deal already won stops being at risk from a document nobody wanted to own.

Frequently asked questions

How long does a security questionnaire take to complete?

Anywhere from a day to six weeks, and the variance comes almost entirely from whether the answers already exist in maintained form. The questions themselves are largely standard. Sourcing and verifying the answers is the work.

Do certifications replace a security questionnaire?

They shorten it. A current SOC 2 Type II or ISO 27001 certificate lets many buyers skip whole sections, and some accept the report in place of the questionnaire entirely. Regulated buyers usually still send their own, because their obligations are specific to them.

What if you cannot meet a security requirement?

Say so plainly and describe the compensating control and any planned work with a date. Reviewers are assessing risk, not perfection, and a documented gap with a mitigation frequently passes. An answer that overstates a control is the one that ends badly, usually during an audit after signature.