To unblock a deal stuck in security review, spend the first two days sorting the customer's requests, then assign owners, gather evidence for the answerable items, send honest "not yet" answers for the rest with dates, and hold a short call. Aim to send one complete response by day eight.
Why deals stall
Security reviews stall for dull reasons: the questions sit in an inbox, nobody knows who can answer, evidence is scattered, or a risky answer is stuck waiting for approval. A calm plan fixes most of it.
The plan
| Days | Goal | Output |
|---|---|---|
| 1 to 2 | Understand the ask | Request list sorted into can answer now, need evidence, cannot meet |
| 3 | Assign owners | Each item has a person and a due date |
| 4 to 6 | Gather evidence | Dependency inventory, scan summary, change control exports, vendor list |
| 7 | Draft answers | Plain, limited, dated statements |
| 8 | Verify and approve | Technical check, approver read for overclaims |
| 9 | Send and offer a call | One response with attachments |
| 10 | Follow up | Log open items and next dates |
Days 1 to 2: sort the requests
Read the whole questionnaire, plus any email context. Sort each item into three groups: answerable today, answerable with evidence you can gather, and not met. Ask the customer which items are mandatory and which are preferences. Often a third are negotiable.
Days 3 to 6: assign and gather
Name an owner for every item, and put the due date in a shared tracker. Gather evidence once and reuse it: a dependency inventory, a recent scan summary, branch protection exports, CI settings, a vendor register. Date every file.
Days 7 to 8: write and check
Write answers in the present tense with specifics. Avoid absolutes. For items you cannot meet, write a short, direct "not yet" with what you do instead and when you expect to change it, only if you control that date. Never claim a certification or an audit result you do not hold. Have a second person verify each technical statement and an approver check for commitments.
Day 9: send with a call offer
Send one response, not a drip of partial ones. Attach evidence through a controlled link. Offer a 30 minute call so the customer's reviewer can ask follow up questions in real time. Calls resolve in minutes what email takes days to settle.
Day 10: close the loop
Log which items remain open, who owns them and the dates. Tell the deal contact what to expect. Update your answer library with every new approved answer so the next review starts further along.
What not to do
- Do not promise a control by a date to close the deal.
- Do not send the raw scan output.
- Do not let sales edit technical answers.
For tips on the answers themselves, see bring down security answers before a deal closes.
Safeguard can supply dated dependency inventories and scan results from its dependency scanning and evidence automation, and a free scan is at https://gold.safeguard.sh/scan.
Quick check
What if we miss the customer's deadline?
Tell them early, give a firm new date you can keep, and send what is ready.
Should we ask for an exception?
You can ask which requirements are mandatory. Do not ask them to waive a control you claim to have.
Who runs the plan?
One named process owner, with engineering verifying technical answers.
Last reviewed: 19 October 2026.
