How to answer a security questionnaire without SOC 2
A vendor security questionnaire is usually the first real security review a startup faces, and it tends to arrive at the worst time: mid-deal, with no security hire and no report to attach. Here's how to answer it well anyway.
The short version
Read the whole questionnaire first. Answer what's true today, name real gaps with a date instead of hiding them. Reuse answers instead of rewriting them each time, and point to one current, dated security page instead of retyping a paragraph. Decide SOC 2 on its own timeline — it isn't a blocker to answering this one honestly.
Read the whole thing before answering anything
Most questionnaires assume a security program you may not have yet — named control owners, a formal risk register, an existing audit. Find those sections before you start writing.
Why it matters: Answering question one before you've seen question forty means rewriting answers once you realise the questionnaire's actual shape, or worse, contradicting yourself later in the same document.
What good looks like
- Skim every section heading before drafting a single answer
- Mark which questions assume a program you don't have
- Group questions by topic (access, data, monitoring, vendors) before answering
- Note which answers you'll reuse next time, as you go
Answer what's true today, not what you intend to do
State your actual current practice. Where there's a real gap, name it plainly and say when it closes — don't phrase a plan as if it were already in place.
Why it matters: A reviewer who catches one inflated answer stops trusting every other answer in the document. An honest gap with a date is a normal, expected line item; a discovered exaggeration is a stalled deal.
What good looks like
- Say "not yet in place, due in Q2" instead of implying it exists
- Don't borrow language from a framework you're not actually following
- If a question doesn't apply to your product, say so and explain why
- Keep the same honest answer even when it's the boring one
Turn every answer into next time's answer
Save every question and its final wording somewhere your team can find it again — a shared doc, a spreadsheet, whatever exists today. The goal isn't a tool, it's not re-deriving the same answer from scratch every time.
Why it matters: The tenth questionnaire asks most of the same questions as the first. Teams that treat each one as a fresh essay burn hours a competitor with a reused answer library doesn't spend.
What good looks like
- One place, however basic, that every past answer lives in
- A quick pass to update stale answers before reusing them, not blind copy-paste
- One person responsible for keeping it current
- Answers written for a reviewer, not lifted verbatim from an internal policy
Have one link to point to instead of a paragraph to retype
For open-ended questions — "describe your access control policy," "how is customer data protected" — a link to a current, structured security page beats a five-paragraph reply written into a form field.
Why it matters: A paragraph in an email thread can't be checked against anything and goes stale the day someone changes a setting. A link a reviewer can open themselves, dated and structured, closes the question without more back-and-forth.
What good looks like
- A public page for the safeguards that are actually running
- A visible "last reviewed" date, so it reads as maintained rather than archived
- Documents split into what's public and what's available on request
- The same link reused across every questionnaire, not a new document each time
This is the specific gap Notice Labs fills: one current page to point at, instead of a paragraph you're retyping into every new form. Create in the admin also makes a security overview PDF from the same page, for questionnaires that ask for an attachment.
Route it through one person
Different people answering the same question differently across different reviews is its own credibility problem, independent of whether any individual answer is accurate.
Why it matters: A reviewer who cross-references two answers from your company and finds them inconsistent reads that as a process failure, even if both answers happen to be true.
What good looks like
- One named owner for security-questionnaire responses
- A short review step before anything goes out, even under deadline pressure
- A consistent voice and terminology across every answer
- A clear escalation path when a question needs an engineer's input
Decide SOC 2 on its own timeline, not this questionnaire's
A SOC 2 report doesn't end questionnaires — it collapses many of the recurring ones into a single attachment. It's a genuine option for reducing this work later, not a requirement for answering the one in front of you well.
Why it matters: Teams sometimes stall a deal trying to fast-track a report instead of just answering honestly with what exists today. The two are separate decisions on separate timelines.
What good looks like
- Answer this questionnaire with what's true now
- Treat SOC 2 as a future investment decision, weighed on its own merits
- Don't let "we'll get SOC 2 eventually" substitute for a real answer today
- Revisit the question once questionnaires are frequent enough to justify it
What actually stalls a review
- Copy-pasting last year's answers without checking they're still true
- A different answer to the same question from two people on the same team
- Implying a control exists because the framework says it should
- A security-page link that 404s or points at a departed employee's Drive
- Treating every questionnaire as a first-time essay instead of a known set
- Waiting on SOC 2 instead of answering what's true today
Worked answers to common questions
Square brackets mark what you fill in. Each answer has a version for when you do it, a version for when you don't yet, and a link to the full control page.
Multi-factor authentication
"Do you enforce multi-factor authentication?"
If you do it
Yes. Multi-factor authentication is enforced for every staff account with access to systems that hold customer data, including [our identity provider, cloud console and source control].
If you don't yet
"Enforced on our cloud console and source control; being rolled out to [system] by [month]." A partial answer with a date beats a bare yes.
Access reviews
"Do you review user access regularly?"
If you do it
Yes. Access to systems holding customer data is reviewed [quarterly] by [role], and anything no longer needed is removed. Leavers lose access on their last day.
If you don't yet
"Access is removed at offboarding through our identity provider; formal quarterly reviews start in [month]." Say what does happen today.
Backups
"Do you back up customer data?"
If you do it
Yes. Customer data is backed up automatically [daily] and kept for [30 days], encrypted, in [a separate region or account]. Restores are tested [every quarter].
If you don't yet
Name the managed service and its retention. If you have never tested a restore, don't claim you have: test one and write down the result.
Incident response
"Do you have an incident response plan?"
If you do it
Yes. Security incidents follow a documented process covering detection, triage, containment, customer notification and review. [Role] owns it, and it was last rehearsed in [month and year].
If you don't yet
A one-page plan naming who does what is enough to start. Say it's new and when you'll first rehearse it, rather than describing a process that exists only in someone's head.
Vendor assessment
"How do you assess the security of your vendors?"
If you do it
Vendors that handle customer data are reviewed before use, by checking their security documentation and data processing terms, and re-reviewed [every year]. Our current subprocessors are listed on our trust center.
If you don't yet
List your subprocessors first, then record a short review for each. Pointing a reviewer at a published list already answers half the question.
There are more in the controls library. This guide was last updated on .
Questions worth asking
What founders ask most often when the first questionnaire arrives.
Do we need SOC 2 to answer a security questionnaire well?
No. Most questions can be answered honestly with your current practices, named gaps, and a link to a maintained security page. SOC 2 reduces future volume; it isn't a prerequisite for answering the one you have now.
What if we genuinely don't have an answer to a question?
Say so, plainly, and add a date if there's a real plan to close it. An honest "not yet" reads better to an experienced reviewer than a vague non-answer or an inflated one.
How much of this can a small team actually do without hiring anyone?
Most of it. An answer library is a shared doc. A security page is one page, not a program. The parts that genuinely need investment — real controls, an actual audit — are separate decisions from answering well today.
Isn't a link to a security page just as easy to fake as a paragraph?
A structured, dated page with public and gated sections is easier for a reviewer to verify at a glance than a paragraph pasted into an email, and it's harder to let quietly go stale because it lives in one place instead of many past email threads.
Where can I find model answers to the common questions?
The Notice Labs controls library has a page for each common question, such as multi-factor authentication, backups and incident response. Each has a model answer, the evidence a reviewer may ask for, and what to say if you don't do it yet.
What if the questionnaire asks for an attachment?
Send the document you have, such as a security overview, and say which questions it covers. Create in the Notice Labs admin makes a security overview PDF from what your trust center publishes, so you aren't writing one for each form.
Related reading
Have one current page ready before the next questionnaire lands.
From £39 a month. No sales call.