I'm curious how people actually deal with this:
- Who ends up answering them (founder, CTO, sales engineer, a consultant)? - Do you keep a bank of past answers, or start from the last questionnaire each time? - What question did you not know how to answer honestly (SOC 2, pen test, MFA, AI usage)? - Did a questionnaire ever cost you a deal or delay one by weeks?
For disclosure: I'm building a tool in this space (I'm the founder), so I'm asking partly to learn what's actually painful. I'm not going to pitch anything in the thread. Stories from the buyer side are just as welcome: what makes a vendor's answers believable to you?
saidnooneever•6m ago
Its a bit silly in the sense they will ask for example for ISO and SOC accreditations and then subsequently go ask about lots of stuff that is covered by those same certifications.
If you struggle on this and there is money on the line, and its a common theme, maybe get someone in to answer them.
Often someone who works on compliance in your org will do. So that person who got you the SOC2 acreditation or evidences it or same for ISO.
You can also get a consultant to help you answer them ofc. A small MSSP might have someone not tooo expensive to help u through the questions.
If you have noone who does these things then you wont be ISOxxxx compliant or have that SOC2 thing... which you will need to solve first anyhow, that person, they can help :)..