Scaling SaaS companies lose enterprise deals to security questionnaires they can’t answer.
Here’s exactly what buyers ask, why “let me check” loses deals, and the 4-week fix that doesn’t require a full-time IT hire.
Focus keyword: SaaS security questionnaire
Your product is ready for enterprise customers. Your sales team has finally booked the meeting with the prospect that could double your ARR. The demo goes brilliantly.
Then procurement sends over a document with 40 to 200 questions, and none of them are about your product.
They’re about your laptops. Your offboarding process. Whether you can prove – not claim, prove – that every device in your company is encrypted.
This is the security questionnaire, and for SaaS companies between 20 and 100 people, it has quietly become the single most common reason a closable deal dies.
Why this hits companies at exactly your size
At 10 people, nobody asks. You’re too small, your deals are too small, and your buyers are usually other startups who don’t have procurement teams.
At 200+ people, you have an IT manager, probably a security lead, ISO 27001 or SOC 2 in progress, and a pre-written answer library. The questionnaire is an afternoon’s work.
It’s the middle – 20 to 100 people – where this becomes lethal. You’re now big enough to sell to companies that have procurement and compliance teams. But you’re still running IT the way you did at 10 people: the office manager hands out laptops, passwords live in someone’s head or a shared spreadsheet, and “offboarding” means remembering to ask for the MacBook back.
The gap between who you’re selling to and how you operate internally is exactly where deals die.
What the questionnaire actually asks
Having filled these in for clients, I can tell you they cluster around four themes, regardless of whether the buyer uses their own template, a CAIQ, or a platform like Vanta or SecurityScorecard sends it on their behalf:
1. Identity and access. Is multi-factor authentication enforced for all employees – not available, enforced? Who has admin access to your production systems and customer data? How is access reviewed?
2. Device security. Are all company devices encrypted? Can you prove it? Are devices centrally managed (MDM), or does each employee configure their own laptop? What happens if a laptop is stolen on a train?
3. Joiner-mover-leaver process. When someone leaves your company, how quickly is their access revoked? Across all systems – not just email, but Slack, your codebase, your CRM, that Notion workspace with your roadmap in it? Is this documented or tribal knowledge?
4. Data handling. Where does customer data live? Who can access it? Is sharing controlled, or can anyone forward a SharePoint link to anyone on the internet?
Notice what’s missing: nothing here requires a security team, a CISO, or a six-figure compliance budget. Every single item is operational hygiene. Which is precisely why “we’re too small for that” doesn’t survive contact with a buyer – they’re not asking for SOC 2, they’re asking whether you’ve done the basics.
Why “let me check” loses the deal
When your sales lead forwards the questionnaire internally and the answers take two weeks to assemble, three things happen on the buyer’s side:
First, the delay itself is the answer. A company that knows its security posture replies in a day or two. A company that has to go and find out signals that nobody owns this – and if nobody owns it now, nobody will own it when there’s an incident involving the buyer’s data.
Second, your competitor answers faster. In any competitive evaluation, the vendor who returns a clean, confident questionnaire while you’re still chasing down whether Dave-who-left-in-March still has GitHub access wins the procurement team’s trust. Procurement doesn’t pick products. It eliminates risks.
Third, the deal momentum dies. Enterprise deals run on momentum. A two-week stall at the procurement stage gives every other stakeholder time to deprioritise, re-scope, or talk to someone else.
The brutal part: your product was never evaluated in this round. Your operations were.
The 4-week fix
Here’s the part founders consistently get wrong: they assume the fix is a £50,000–65,000 full-time IT manager, conclude they can’t afford it, and do nothing.
The actual fix is a bounded project.
Here’s what it looks like for a typical 30–70 person SaaS company running Microsoft 365 or Google Workspace:
Week 1: Identity lockdown
Enforce MFA for every account through conditional access policies — no exceptions, no “the CEO finds it annoying” carve-outs (that exception is the first thing an attacker, and an auditor, looks for). Audit admin roles and strip them back to the people who genuinely need them. Kill shared accounts.
Deliverable: an enforcement policy that’s active, plus a one-line answer for the questionnaire: “MFA is enforced tenant-wide via conditional access; admin roles follow least-privilege and are reviewed quarterly.”
Week 2: Device management
Deploy MDM (JumpCloud, Jamf, Iru even intune – the tool matters less than having one) to every company laptop. Enforce disk encryption, screen lock, and OS update policies through it. The point isn’t control for its own sake – it’s that encryption you can’t prove doesn’t exist as far as a buyer is concerned. MDM turns “we think laptops are encrypted” into a compliance report you can export.
Deliverable: every device enrolled, encryption provable in one screenshot.
Week 3: Joiner-mover-leaver process
Document and test the offboarding sequence: identity disabled first (which kills SSO-connected apps in one move), then the stragglers – anything with its own login, shared credentials rotated, device remotely locked and wiped. Run it once against a test account so it’s verified, not theoretical. Do the mirror image for onboarding so new starters get exactly the access their role needs and nothing more.
Deliverable: a one-page documented process where departing employee = zero lingering access, same day.
Week 4: Data sharing controls and the answer document
Lock down external sharing defaults in SharePoint/Google Drive so “anyone with the link” isn’t the default state of your customer data. Then write the document that makes all of this pay off: a one-page security overview your sales team can attach to any questionnaire or send proactively. Every answer pre-written, every claim backed by a control that actually exists.
Deliverable: your sales team answers the next questionnaire same-day, without forwarding it to anyone.
What this costs vs. what it’s worth
A full-time IT manager in the UK runs £50,000–65,000 plus recruitment, benefits, and a three-month hiring timeline and most 30–70 person companies genuinely can’t justify it.
The project above is 2–4 weeks of focused fractional work. It costs a fraction of one month of that salary, and it directly unblocks revenue: the next enterprise deal that hits procurement sails through instead of stalling.
There’s a second-order benefit too. Everything above is roughly 70% of the control set for Cyber Essentials certification which more and more UK buyers now require outright. Do this work once, and certification becomes a formality rather than a scramble.
The signal to act on
If you can answer “yes, and I can prove it” to all four of these right now, you’re fine:
- Is MFA enforced (not just available) for everyone?
- Could you export a report today showing every laptop is encrypted?
- If someone resigned this morning, would their access – all of it be gone by lunch?
- Could your sales team return a security questionnaire within 48 hours without escalating it?
If any of those made you hesitate, the questionnaire that exposes it is already in someone’s outbox. The only question is whether it arrives before or after you’ve fixed it.
Also you can check my free IT assessment tool that might give you a good idea what could be not working properly and what gaps you could have!
https://ITops.zlefterov.com
I’m Zhivko Lefterov, a fractional IT consultant for scaling SaaS and fintech companies (20–100 people). I do this work without the full-time cost. If a security questionnaire landing tomorrow would cause panic, get in touch — the first call is free.