The SaaS Security Questionnaire: How Small Teams Handle SOC 2, SIG and Buyer Reviews

How can small SaaS teams handle security questionnaires, SOC 2 requirements and SIG assessments?

Build one honest answer library backed by a small set of controls you really operate: SSO and MFA, access reviews, encryption, backups, logging, vulnerability management, vendor management and incident response. Publish a simple trust page so buyers can self-serve, answer standard questionnaires such as the SIG or CAIQ from that library, and start a SOC 2 programme once buyers in your pipeline are asking for the report rather than before.

What buyers are actually asking for

When a mid-sized or enterprise customer evaluates your product, their security or procurement team needs evidence that adding you as a vendor won't create an unacceptable risk. That evidence usually arrives in one of four forms, and it helps to know which is which before you start answering:

SOC 2 in plain terms

The AICPA describes SOC as a suite of services that CPAs may provide, and it sets the professional standards for those engagements. A SOC 2 examination reports on controls relevant to five Trust Services Criteria categories: security, availability, processing integrity, confidentiality and privacy. Security is the baseline and the others are added when they matter to your service. Two points are frequently misunderstood:

• SOC 2 is an attestation, not a certification. A CPA firm examines your system description and controls and issues a report with its opinion. There is no "SOC 2 certified" badge from the AICPA, so avoid that phrase on your website.
• Type 1 and Type 2 are different reports. A Type 1 report covers whether your controls are suitably designed at a point in time. A Type 2 report also covers whether they operated effectively over a period, and the auditor tests samples from that period. Buyers who ask for SOC 2 usually mean Type 2, because it proves the controls ran, not just that they existed on one day.

SIG, CAIQ and ISO 27001 in one paragraph each

SIG: Shared Assessments publishes the Standardized Information Gathering questionnaire for third-party risk management. Its own training materials distinguish a SIG Core and a SIG Lite, and buyers can scope the questionnaire to the risk areas they care about, so the version you receive may be shorter or longer than the last one. Check which edition and scope the buyer has sent before you start.

CAIQ: The Cloud Security Alliance's Consensus Assessments Initiative Questionnaire is a set of yes/no questions built into its Cloud Controls Matrix (CCM). At the time of writing the CSA lists CCM and CAIQ version 4.1 and lets cloud providers self-assess and submit to its STAR Registry, which some buyers accept in place of their own questionnaire.

ISO/IEC 27001: the international standard for an information security management system. ISO itself says it does not certify organisations or issue certificates; certification is carried out by external certification bodies, and ISO points buyers to accreditation bodies and the IAF CertSearch database to check them. It suits companies selling heavily into Europe or to buyers who name it in tenders.

The practical system: answer library, policies, evidence

1. Start an answer library. One document or spreadsheet with your standard answer to each recurring question, the owner, the date it was last checked and a link to supporting evidence. Every new questionnaire becomes mostly copy and adjust.
2. Write short policies you follow. Information security, access control, acceptable use, incident response, business continuity and backup, vendor management, data retention and secure development. Two pages each that match reality beat forty pages copied from a template. Name an owner and a review date.
3. Collect evidence as you go. Screenshots or exports of MFA enforcement, a quarterly access review, the last restore test, dependency scanning results, signed DPAs with sub-processors, and incident or tabletop notes. Automate the exports where your tools allow it.
4. Answer honestly, including "no" and "partially". A "no" with a compensating control and a date ("we do not yet have SOC 2; we plan to begin our observation period in Q2, and our controls are described here") is better than a "yes" an auditor or the buyer later disproves.
5. Track every questionnaire. Buyer, format, date sent, who answered, follow-up questions. Patterns in the follow-ups tell you which control to improve next.

The controls that come up in almost every review

For secure software development specifically, two free references are worth pointing reviewers to. OWASP's Application Security Verification Standard (ASVS), at version 5.0.0 at the time of writing, provides a list of requirements for testing web application security controls. NIST SP 800-218, the Secure Software Development Framework (SSDF) version 1.1, describes high-level secure development practices that can be integrated into any development lifecycle. Mapping your practices to one of these makes the "secure SDLC" section of a questionnaire easy to answer. Our guide to custom web application security covers the engineering side.

Publish a trust page

A trust page or trust centre is a public (or partly gated) page that answers the first round of questions before they are asked: where data is hosted, your sub-processors, how you handle encryption, access, backups and incidents, your status page, which reports you hold and how to request them under NDA. Our own trust page is a simple example of the format. Commercial trust-centre tools add access requests and NDA workflows, but a well-maintained page on your own site is enough for an early-stage company. The rule that matters is that everything on it must be true today.

When to buy a compliance automation platform

Compliance automation platforms connect to your cloud, identity provider, code host and HR system, check controls continuously, collect evidence and provide policy templates. In our view they are worth it when you have committed to a SOC 2 or ISO 27001 audit date, because they save a lot of manual evidence gathering and keep you honest between audits. They are not worth it before you have a real buyer requirement, and they do not implement controls for you: someone still has to turn on MFA, run the access review and test the restore. Compare pricing on the vendors' own sites, and check which audit firms they work with.

When to start SOC 2

• Start now if deals in your pipeline are blocked or delayed specifically because you lack a SOC 2 report, or a large contract makes one a condition.
• Prepare but wait if you sell to small and mid-sized businesses that accept a completed questionnaire and a trust page. Put the controls in place anyway; they are what protect your customers.
• Consider ISO 27001 instead or as well if your buyers are mainly in Europe or name it in procurement.
• Consider the CSA STAR self-assessment as a low-cost interim step if your buyers are cloud-security-minded and accept CAIQ.

If your product's architecture is the blocker (for example, enterprise buyers asking about tenant isolation), our guide to multi-tenant SaaS architecture explains the options, and our secure AI development work covers questionnaires that now include AI-specific questions.