Five questions every enterprise buyer will ask you

Security reviews look endless from the vendor side, hundreds of questions across spreadsheets and portals. Underneath, most of them come back to five things a buyer needs to know before giving you their data.

If you can answer these five with evidence, you'll pass most security reviews quickly, whatever format they arrive in. If you can't, no amount of polish on the other 295 questions will save the timeline.

I've sat on both sides of these reviews, preparing fintech vendors for bank assessments and reviewing vendors on behalf of the companies buying from them. The questions below are the ones where deals actually slow down.

Why buyers ask at all

Many buyers are required to. RBI's 2023 directions on outsourcing IT services make Indian banks accountable for their vendors. The EU's Digital Operational Resilience Act, applying since January 2025, requires financial firms to keep a register of their ICT third party providers and to assess them. GDPR Article 28 requires controllers to use only processors that give sufficient guarantees. Your buyer's auditor will ask them what they checked about you.

1. Can you send us your security policy and latest audit report today?

The test here is speed and currency. A buyer wants a policy that matches how you operate and a SOC 2 or ISO 27001 report that isn't more than a year old. If your last report is older, have a bridge letter ready. A trust page with these behind an NDA answers this in minutes.

2. Which vendors can access our data, and when did you last review them?

This is your subprocessor list plus evidence of review. Most companies have the list. Few have dated reviews. If you've ever pasted a subprocessor list into a questionnaire and realised it was missing the analytics tool marketing added in spring, you know why buyers ask.

3. If we asked you to delete our data, could you prove it?

Buyers want a documented deletion process covering production, logs, backups and your own vendors, plus a record that it was done. "Backups expire after 35 days" is an acceptable answer if it's true and written down. Under DPDP and GDPR, people's rights requests make this a legal question too.

4. Who left in the last 90 days, and when was their access removed?

Offboarding is where small companies are weakest, because it depends on someone remembering. Buyers want to see a leaver list and a timestamp of access removal for each person, ideally within a day. This one is cheap to fix and expensive to get wrong.

5. When did you last test your incident response plan?

Having a plan is table stakes. Buyers want the date of the last tabletop exercise, who took part and what changed afterwards. A plan that has never been tested is a document about a company that has never had a bad day.

What a good answer looks like

Short, specific, dated and backed by a document or record the buyer can see. "Yes, quarterly" is weak. "Quarterly, last completed 12 September, report attached" is strong. Where you have a gap, say so and give the date it will close. Buyers forgive gaps far more readily than they forgive guesses.

This is the bar we set for Steppe's client view: each of these five should be answerable in under a minute by someone who isn't the CTO. If that's not true in your setup, whichever tool you use, the next review will tell you.

Buyers forgive gaps, and they never forgive guesses that turn out to be wrong.