How to answer a security questionnaire without SOC 2

A bigger customer wants to buy your software. Then their security team sends a spreadsheet with 100 or more questions, and the deal waits until you send it back.

If you don't have a SOC 2 report, you can still answer it. You answer every question honestly, explain each gap with what covers it today and when it will be fixed, and back up your answers with evidence you already have.

This guide walks through how to do that, step by step, with an example of a gap answer you can adapt.

What a security questionnaire is

A security questionnaire is how a buyer checks a vendor's security before trusting it with their data. It asks how you protect customer data, who can access it, how you handle incidents, and which outside services you rely on.

Most questionnaires you'll see fall into 3 types:

A SOC 2 report is different. It's an examination by a CPA of a company's controls relevant to security, availability, processing integrity, confidentiality or privacy, as described by the AICPA. Some buyers will take a SOC 2 report in place of part or all of their questionnaire. When you don't have one yet, the questionnaire is how you make your case.

How to answer a security questionnaire without SOC 2

1. Read the whole questionnaire before answering anything

Skim every question first and note the deadline, the answer format the buyer wants (Yes/No, free text, or both), and any questions that need a document attached.

You'll notice many questions ask about the same thing in different words. MFA, encryption and access reviews can come up several times across one form.

2. Gather the facts once

Before writing answers, collect the facts behind them in plain language: where your app is hosted, what customer data you store, who can reach production, whether MFA is on, how backups work, and what happens when someone leaves.

Writing these down once keeps your answers consistent. Buyers notice when question 12 says one thing and question 87 says another.

3. Answer what is true today

Answer each question based on what your company does now. Plans belong in gap answers, with a date. A questionnaire can end up attached to the contract, so a Yes you can't back up is a risk to the deal and to you.

Use 4 answers consistently:

• Yes: the control is in place and you can show evidence.
• Partial: some of it is in place. Say which part.
• No: it isn't in place yet. Explain what covers the risk today.
• N/A: the question doesn't apply to your service. Say why in one line.

4. Write a clear answer for every gap

A No or Partial doesn't have to end the conversation. A short, specific gap answer shows the buyer you understand the risk and have a plan. The next section shows how to write one.

5. Point to evidence you already have

You probably have more evidence than you think: screenshots of MFA settings in Google Workspace or Microsoft 365, your cloud provider's encryption settings, a list of the outside services that handle customer data, and records of offboarding.

List what's available on request rather than attaching everything. Buyers will ask for what they need.

6. Write down the basic policies

Many questions ask whether a written policy exists. Small teams often follow good practices without writing them down.

Short written policies for acceptable use, passwords and MFA, remote work and incident reporting can turn several No answers into Yes answers, as long as they describe what your team actually does. The Security Policy Starter Pack covers those 4.

7. Save every answer for next time

The next buyer will send a different questionnaire that asks about the same facts. Keep your approved answers in one spreadsheet with an owner and a review date for each. Your second questionnaire becomes mostly copy and paste.

How to write a gap answer

A good gap answer has 3 parts:

1. What's true today. State the gap plainly.
2. What covers the risk now. Name the controls already in place that reduce it.
3. What happens next, and when. Give a realistic date your team has agreed to.

Here's an example from our sample questionnaire, written for a fictional 14-person SaaS company.

Question: Has the application had an independent penetration test in the last 12 months?

Answer: No.

Response: Not yet. We run automated scanning of the application and its dependencies on every code change, and critical findings block release until they are fixed. An independent penetration test is booked for Q1 2027, and we'll share a summary letter with customers afterward.

The answer states the gap plainly, shows the buyer what reduces the risk today, and gives them a date to hold you to.

Only commit to dates your team can meet. A missed date on a questionnaire is harder to explain than a gap.

Mistakes to avoid

Answering Yes to what you plan to do. A planned control is a gap with a date. Write it that way.

Giving a bare No. A single word leaves the buyer to assume the worst. Add what covers the risk today and when the gap will close.

Using N/A to skip hard questions. Reviewers notice. Use N/A only when the question truly doesn't apply, and say why.

Contradicting yourself. If you say all staff use MFA in one answer and that some systems don't support it in another, the buyer will ask which is true. Gathering the facts once, as in step 2, prevents this.

Copying answers from another company. Template answers describe someone else's systems. Every answer should match what your team does.

Sending it without a final review. Have the person who knows your systems best read every answer before it goes to the buyer.

Need help with your first one?

If a questionnaire is holding up a deal, Polaris can complete your first one with you. You tell us how things work, and you get honest, buyer-ready answers, a reusable answer library, 4 core policies and a draft trust page. You review and approve every answer before it goes out. See the service and a full sample.

Sources

• What is the SIG?, Shared Assessments
• What is CAIQ?, Cloud Security Alliance
• System and Organization Controls: SOC suite of services, AICPA & CIMA

Sources checked October 2026.