Is receiving a security questionnaire good or bad news for the deal?

Good news: questionnaires are sent in procurement or security review, which means the buyer is seriously evaluating you. The risk is not the questionnaire itself — it is answering it late, or answering it with claims that collapse in due diligence.

Can I ask the buyer for a deadline extension?

You can ask — a short, specific request ("we want to give you accurate answers rather than fast ones; can we deliver by Friday?") is a normal part of vendor reviews. Whether it is granted depends on the buyer. A better position is not needing one: know your delivery path before you commit to a date.

Who should answer the questionnaire in a small software company?

In vendors of roughly 10–50 people there is often no dedicated security or compliance hire, so it lands on a founder or CTO. Whoever answers, one person should own consistency: contradictory answers across sections are a common due-diligence flag.

Should I answer 'yes' to a control we only partially have?

No. State what exists today and add a remediation step with a date. Buyers routinely accept honest gaps with a plan; what they do not forgive is discovering an overstated 'yes' later — that damages the whole document's credibility.

Do AI sections change anything from August 2026?

Yes. The EU AI Act's Article 50 transparency obligations apply from 2 August 2026 and were not postponed by the Digital Omnibus, so AI sections (AI-CAIQ, SIG 2026 AI domain, custom AI questions) reference obligations that apply from that date. If you ship AI features under your own brand, check which Article 50 duties apply to you before answering.

Playbook

Received a security questionnaire? What to do in the first 24 hours

Last updated: 28 July 2026 · By the Deal Rescue team · Answering these questionnaires is our whole service; this is the triage it is built around.

First: this is good news. Security questionnaires arrive when a deal reaches procurement or security review — the buyer is seriously evaluating you. The questionnaire is not the threat. The threats are (a) answering late while the deal loses momentum, and (b) answering with claims that collapse later in due diligence. The first 24 hours decide both.

Hour 1: identify what you actually received

Open it and classify before anyone starts typing. The format tells you the effort and the playbook:

SIG Lite / SIG Core (Shared Assessments): standardized; SIG Lite is the short tier, SIG Core is substantially longer. Common from buyers in financial services, healthcare and insurance. Since the 2026 version there is a dedicated AI domain — see our SIG 2026 AI-domain guide.
CAIQ / AI-CAIQ (Cloud Security Alliance): cloud controls; the AI-CAIQ (October 2025) is emerging as a common instrument for AI due diligence — see the AI-CAIQ guide.
Custom spreadsheet or portal (Excel, OneTrust, Whistic, KY3P…): anything from 20 to hundreds of questions. Check whether questions are actually phrased as questions — export quirks matter when you scope effort.
AI section inside any of the above: increasingly standard. If your product ships AI features, this is where accuracy matters most right now — Article 50 of the EU AI Act applies from 2 August 2026.

Count the questions, note the stated deadline, and note who sent it (procurement, security team, or your champion forwarding it — your champion is your ally for context and extensions).

Hour 2: protect the timeline

Acknowledge receipt the same day. One line to the sender: you have it, you are on it, and when they will get answers. Silence is how deals stall.
Commit to a date you can actually hit. Decide the delivery path first (next section), then promise the date.
If the deadline is impossible, ask early, not on the due date. A short, specific request framed around accuracy is a normal part of vendor reviews. Asking on day one reads as organized; asking on the deadline reads as drowning.

Hour 3: decide who answers it

Three viable paths — the honest decision criteria are in our full comparison with real 2026 prices:

In-house: right when someone on the team knows the frameworks being asked about and the deal can wait for internal time. Method: how to answer the AI section.
A per-questionnaire service: right when the questionnaire is the exception and the deal is blocked now. That is what we do: $490 flat up to 60 questions, drafts in 48 hours, every legal claim cited to its article, paid after delivery — judge the public sample first.
A GRC platform: right when this is your fifth questionnaire this year and compliance is becoming a program, not an incident — see platform vs. service vs. DIY.

Whichever path you choose, one person owns consistency. Contradictions between sections (encryption "yes" in one tab, "partially" in another) are a classic due-diligence flag.

The two mistakes that actually kill deals

The hopeful "yes". Answering "yes" to a control you partially have feels harmless and is the most expensive mistake in the document. State what exists today; put what's missing in a gap statement with a remediation step and a date. Buyers accept honest gaps with plans. They do not forgive discovering an overstated yes.
Legal claims without sources. AI sections now reference a regulation that is in force. Unsourced paraphrases ("we comply with the EU AI Act") invite follow-up questions you may not want. Every legal claim should cite its article — it also signals you know the terrain better than the reviewer does.

If your product ships AI features: check which Article 50 transparency duties actually apply to your feature before answering anything about them — the answer depends on what the feature does and on whether you ship under your own brand. Our free Article 50 checker maps it in six questions, no email required. Deeper: who owes what under Article 50.

The first-24-hours checklist

☐ Classified the format (SIG / CAIQ / AI-CAIQ / custom) and counted the questions
☐ Noted deadline, sender, and your internal champion
☐ Acknowledged receipt with a committed date
☐ Chosen the delivery path (in-house / service / platform)
☐ Named one owner for consistency
☐ Ran the AI features through the Article 50 checker (if applicable)

Received a security questionnaire? What to do in the first 24 hours

Hour 1: identify what you actually received

Hour 2: protect the timeline

Hour 3: decide who answers it

The two mistakes that actually kill deals

The first-24-hours checklist

Deal blocked by this questionnaire right now?