[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-security-questionnaire::en":3,"gloss-cluster-security-questionnaire::en":26,"gloss-next-security-questionnaire::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"security-questionnaire","saas","Security Questionnaire","A security questionnaire is a structured set of questions a prospective customer sends a vendor to assess how that vendor handles data, access, availability and incidents before signing. In B2B SaaS it is a routine part of procurement above a certain deal size, arriving from the buyer's security or compliance team well after the product evaluation has been won on features. Formats range from a company's own spreadsheet to standardised frameworks such as SIG or CAIQ, and answers commonly need to be reconciled with whatever certification the vendor holds. What the questionnaire actually gates is the deal, which makes it a revenue problem as much as a security one. A slow or evasive response stalls a signature that everything else is ready for, and because the questions arrive late, the delay lands entirely inside the quarter someone was counting on. Vendors who treat it as an engineering interruption tend to answer each one from scratch, which is both the slowest path and the one most likely to produce inconsistent claims across two customers — a discrepancy a buyer's team will eventually notice. The compressing move is to answer once and reuse. A maintained answer library, keyed by question intent rather than by wording, lets a new questionnaire be assembled largely from approved text, with genuinely new questions escalated to the people who can answer them. A public trust centre compresses it further by publishing the certifications, sub-processor list, architecture summary and data handling policies that most questionnaires ask for, which lets buyers self-serve the easy eighty percent. Certification such as SOC 2 or ISO 27001 does not remove the questionnaire, but it collapses whole sections into a reference to the report. The one rule that matters more than speed is accuracy. Answers become contractual representations, and a control described as implemented when it is planned is a misstatement in a document the customer will retain. Practical note: keep the answer library under version control with a named owner and a review date per answer, and record which customers received which version — when a control changes, you need to know who was told the old thing.","A security questionnaire is a buyer's structured due-diligence review of a vendor's controls, and for B2B SaaS it is a routine gate on deals above a certain size.",null,[11,14,17,20,23],{"slug":12,"name":13},"iso-27001","ISO\u002FIEC 27001",{"slug":15,"name":16},"penetration-testing","Penetration Testing (Pen Test)",{"slug":18,"name":19},"soc-2","SOC 2",{"slug":21,"name":22},"sub-processor","Sub-processor",{"slug":24,"name":25},"trust-center","Trust Center",[27,31,35,38,41,44,47,51,54,57,60,63],{"slug":28,"category":5,"name":29,"updated_at":30},"activation","Activation","2026-08-24T02:46:36+00:00",{"slug":32,"category":5,"name":33,"updated_at":34},"aha-moment","Aha Moment","2026-08-24T02:46:37+00:00",{"slug":36,"category":5,"name":37,"updated_at":34},"annual-contract-value","Annual Contract Value (ACV)",{"slug":39,"category":5,"name":40,"updated_at":30},"api-first","API-First",{"slug":42,"category":5,"name":43,"updated_at":30},"arpa","Average Revenue Per Account (ARPA)",{"slug":45,"category":5,"name":46,"updated_at":30},"arr","Annual Recurring Revenue (ARR)",{"slug":48,"category":5,"name":49,"updated_at":50},"auto-renewal-clause","Auto-Renewal Clause","2026-08-24T02:46:38+00:00",{"slug":52,"category":5,"name":53,"updated_at":50},"build-vs-buy","Build vs. Buy",{"slug":55,"category":5,"name":56,"updated_at":34},"burn-multiple","Burn Multiple",{"slug":58,"category":5,"name":59,"updated_at":50},"burn-rate","Burn Rate",{"slug":61,"category":5,"name":62,"updated_at":30},"cac","Customer Acquisition Cost (CAC)",{"slug":64,"category":5,"name":65,"updated_at":30},"cdn","Content Delivery Network (CDN)"]