Before your first enterprise security review, have an inventory, automated dependency and code scanning, a written vulnerability handling rule, access controls with multi-factor authentication, an incident process and evidence for each. Be accurate about what you do not have yet. Reviewers value honesty over polish.
What reviewers usually ask
Questionnaires differ, but common themes recur:
- How do you find and fix vulnerabilities in your code and dependencies?
- Do you keep a software bill of materials?
- How are changes reviewed and released?
- How do you manage secrets and access?
- What is your incident process?
- Which frameworks or standards do you follow?
NIST SP 800-218 is often cited for secure development practices, so it helps to map your practices to its vocabulary.
Preparation steps
- Collect real answers. Write each from actual settings, not aspirations.
- Attach evidence. Scan reports, pull request review settings, policy documents.
- Generate an SBOM for the product and know how to share it.
- Write a vulnerability policy of one page with targets and exceptions.
- Name a contact for security questions, so answers come from one person.
- Keep an answer bank with owners and last verified dates.
Evidence map
| Claim | Evidence that supports it |
|---|---|
| We scan dependencies | Recent scan output and the schedule |
| Code is reviewed | Branch protection settings |
| We fix severe issues quickly | Closed ticket history |
| We keep an SBOM | A generated file in an open format |
| We respond to incidents | A written procedure, dated |
What not to claim
Do not call yourself certified or compliant unless an independent party has said so. Do not describe an audit in progress as complete. Do not use absolute words such as always or never without proof. Overclaiming costs more than a gap, since a single contradiction in follow up questions ends trust.
Handling gaps
If you lack a control, say so, state the plan and give a date you control. Many buyers accept a credible plan for non critical gaps.
Quick check
Do we need a certification before the first review?
Not always. Many first reviews accept a clear description of practices and evidence. Some buyers require specific reports, so ask early.
Who should answer the questionnaire?
One accountable person, with input from the control owners. Ad hoc answers from several people drift out of sync.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at the inventory of components. That is the base for the SBOM many reviewers request.
Safeguard offers SBOM and dependency scanning plus compliance and evidence automation to keep answers grounded in current data. It does not certify you. Try a free scan.
Sources
- NIST SP 800-218, Secure Software Development Framework v1.1. Paraphrased.
Last reviewed: 19 October 2026.
