Skip to content
Log in
← Glossary

security questionnaire

Also called: security review, vendor security assessment

A list of questions a buyer's IT or security team sends a vendor about how it stores, protects and processes their data: access, encryption, backups, subcontractors, incident response. Accurate answers kept ready shorten the deal; guesses come back later as blockers.

A security questionnaire is a list of questions a buyer's IT or security team sends a vendor before approving it: where the buyer's data is stored, who can access it, how it is encrypted and backed up, which subcontractors process it, how long it is kept, and what happens after an incident. For any product that touches employee or customer data, it is a standard step, not a sign of distrust.

It is also a common reason deals stall late. The questionnaire arrives after the users have said yes, the vendor answers in a hurry, and a vague or wrong answer comes back weeks later as a blocker. The fix is to treat it as part of the sale: ask in discovery who reviews new vendors, request the questionnaire early, and keep a maintained set of accurate answers that someone responsible for the product's security has checked.

Accuracy matters more than polish. "We don't do this yet, and here is how we handle the risk" is a usable answer; a confident claim the vendor cannot back up is a liability that can surface in the contract or after an incident. Answer about the real setup, including the subcontractors that process data (video hosting, AI processing, payments), and offer a short call with the security reviewer when a question needs context. This is product and process information, not legal advice; contract terms on data protection go to lawyers on both sides.

Example

In the first call, Pavlo from Veloria mentions that IT security reviews any new app. Klasna for Teams asks for the questionnaire that day instead of waiting for it after the demo. Veloria's IT security lead also joins the last 15 minutes of the demo on 3 December, where the questions are concrete: where employee data and lesson recordings live, who at Klasna can see them, which subcontractors process them (video and AI), and how long recordings are kept.

The answers go back on 9 December, the first step of the mutual plan. The timing matters because Veloria's 2027 budgets close on 15 December: if IT security were still waiting for answers, the program, 300 lessons a month or 2,880,000 UAH of fees a year, could miss the budget and wait a year. The 12 dispatchers of the paid pilot from 11 January also use the app, so the review had to be finished before the first lesson anyway.

Common mistakes

  • Waiting for it to arrive. Ask in discovery who reviews new vendors and request the questionnaire early.
  • Answering from memory or marketing copy. Answers must describe the real setup and be checked by whoever owns security.
  • Overclaiming. A confident "yes" you can't support is worse than an honest "not yet, and here is how we manage it".
  • Forgetting subcontractors. Video hosting, AI processing and payment providers handle data too, and reviewers ask about them.
  • Rewriting it from scratch every time. Keep a maintained answer set and update it when the product or its suppliers change.

Learn it in the course