Answer "no" plainly, then add three things: what you do today that reduces the same risk, a dated plan you actually control, and the evidence you can show now. Reviewers expect gaps from young companies. What costs deals is a confident answer that falls apart on a follow-up call.
Why honesty wins
A reviewer sees dozens of questionnaires. They know a seed stage company will not have every control. They look for whether your answers are consistent and whether you know your own gaps. CISA's Secure by Design material asks software makers to embrace radical transparency and accountability, which is the same instinct applied to your own reviews.
An overstated answer creates two risks. You may lose the deal when it is exposed, and a written claim in a contract can become a representation you are held to.
The four part answer
- State the fact. "We do not yet have a formal annual penetration test."
- Describe compensating practice. "We run dependency scanning on every pull request and static analysis in CI."
- Give a plan with a date. "A third party test is scheduled for the first quarter, with a summary available after."
- Offer evidence. "We can share the latest scan summary under NDA."
Only put a date in writing if you control it. If it depends on a vendor's calendar, say "targeted for" and update the buyer when it moves.
Wording to avoid
| Weak | Better |
|---|---|
| "Yes" when you mean "partly" | "Partly: enforced for staff, optional for customers" |
| "Not applicable" to dodge | "Not applicable because we do not store payment card data" with a reason |
| "In progress" with no detail | "Policy drafted, owner assigned, review due in November" |
| "Industry standard" | Name the actual practice |
| "We are compliant" | Say what you do, and what evidence exists |
Triage your gaps first
Before you open a questionnaire, list the controls buyers ask about most and mark yours green, yellow or red. Fix cheap reds first: enforcing MFA, branch protection, an incident contact page, a basic risk register. Leave expensive items, such as an audit, on a dated plan.
Handling follow ups
If a reviewer pushes on a gap, offer a short call with the engineer who owns the area, not a salesperson. A direct technical conversation often settles a concern that a questionnaire line could not. Keep a log of commitments you make, and check them at each quarter end.
Quick check
Will a "no" lose the deal?
Not usually. An honest no with compensating practice and a credible plan reads better than an answer that falls apart on a follow up.
Should we put a date on every plan?
Only dates you control. For dependent items use "targeted for" and keep the buyer informed if it moves.
Safeguard's compliance and evidence automation helps you see gaps and keep evidence for the controls you do have. The free scan gives you dependency facts to cite.
Sources
- CISA, Secure by Design resource: the three principles, including radical transparency and accountability. Paraphrased.
Last reviewed: 19 October 2026.
