# A security questionnaire landed mid-deal: who answers it, where it lives in Pipedrive, and what to tell the buyer

https://salesbond.app/blog/sales-security-questionnaire-pipedrive/
Published: 2026-10-06 · Updated: 2026-10-26

When a buyer sends a security questionnaire in the middle of a deal, treat it as a deal blocker with an owner and a date, not a form to fill in later. Name one person who answers it, answer honestly even where the honest answer is no, attach the file and a due date to the deal in Pipedrive, and tell the buyer when you will send it back. If that date pushes the signature past the close date in your forecast, move the close date the same day.

A security questionnaire, sometimes called a vendor security assessment, is the list of questions a buyer sends a supplier about how it protects their data: access control, encryption, backups, incident response, subprocessors. It usually comes through procurement, at a first purchase or at renewal, and the contract waits until it is answered. This piece is for small teams: a founder who sells, one or two engineers, nobody with “security” in their title. The wider paper stage is in [deals stuck in legal and procurement](https://salesbond.app/blog/deals-stuck-in-legal-procurement-pipedrive/). Here we take one document from that stage, the one with its own owner problem and its own honesty problem.

## “Please complete the attached by Monday”

Thursday, mid-morning. Esther runs a nine-person company and still carries the biggest deals herself. In one of them the head of operations has already asked which address the invoices should go to, and the close date in Pipedrive says October 30. Then an email arrives from procurement, an address she has never seen, with the buyer’s IT lead in copy: “Please complete the attached vendor security assessment by Monday.”

The attachment is an xlsx with 120 rows across five tabs: Access control, Data protection, Incident response, Business continuity, Subprocessors. Each row has an Evidence column, empty. Row one asks whether the company maintains an information security policy approved by management. Esther reads that far, closes the file and has two thoughts in the right order. Monday is not happening. And whose job is this?

Both matter more than any row. The close date became fiction the moment the email arrived, because nothing gets signed until the file goes back and someone on the buyer’s side reads it. And a task with no owner goes to whoever worries most, usually the founder, usually at eleven at night. That is how 120 rows quietly cost a team a week and a handful of answers it later regrets.

Is the buyer’s Monday realistic? Maybe not. But the honest return date is a matter of days, not weeks, because the wait gets read as an answer too. A guide for small SaaS teams on building a questionnaire kit quotes a security leader on the buying side (@AccidentalCISO, 2021): if a vendor takes three to four weeks to turn around a short questionnaire, “that is going to speak more loudly than any of the actual answers in your response” ( [buildmvpfast: vendor security questionnaire kit for small SaaS](https://www.buildmvpfast.com/blog/vendor-security-questionnaire-small-saas-tprm-kit-2026)). So answer the deadline with a date you can keep.

## Whose job is this?

The deal owner owns the questionnaire. Not the answers, the return. Those are different jobs, and in a small team they should sit with different people.

The person who answers is whoever can fill the most rows without asking anyone: the engineer who set up the cloud account, the technical co-founder, whoever last touched the backup job. The salesperson reviews. Why not the other way round? Because the rows that hurt deals are rarely technical. They are the “do you have a documented policy for X” rows where the true answer is no, and sales needs to know which ones those are before the buyer does, so that conversation happens on your call and not in their internal review. When the questions outgrow the rep during the deal, [call a technical person in and write it down](https://salesbond.app/blog/sales-engineer-handoff-pipedrive/).

The temptation is for sales to just fill it in, file already open, deadline already ticking. We think that is the wrong trade. Salespeople answer optimistically, and every row answered by someone who does not run the system is a row you may have to walk back later with their security lead on the line. A late file is recoverable. A corrected answer is a different kind of deal.

On day one sales forwards the file with the deal link, agrees an internal due date both people believe, and sends the buyer the return date. The review later is tedious and simple: read every “No”, and every “Yes” that sounds cleaner than the company is.

Esther asks Jude, who built the hosting setup, to answer. She keeps the review and blocks two hours on Tuesday afternoon for the read-through. That is the whole plan, which is more than most teams have.

## Don’t answer more mature than you are

The most expensive mistake is answering as the company you intend to be. A questionnaire is not a one-time form. The buyer’s security team may ask for teh evidence behind row 47 next week, at renewal, or after an incident on their side when they re-read every vendor’s answers. A “Yes” on annual penetration testing when you ran one scanner once is a sentence you will have to defend with your name under it.

When the honest answer is no, it can take three shapes, and each of them beats a soft yes.

The first is “No, and here is what we do instead.” No written incident response plan, but here is who handles incidents and how customers are told. A compensating control, named plainly, answers what the row is really asking: will we find out if something goes wrong with you.

The second is “Not yet, planned for a specific quarter.” Use it only when the work is actually scheduled. If the plan is “someday” the answer is no.

The third is “Not applicable, because.” You do not store card data because billing runs through a payment processor. You have no on-premise servers. The reason is the answer; without it, “N/A” reads as evasion.

Two rows almost every questionnaire contains are backup and deletion, and for the data you hold in your CRM we have already written both answers out: [how we back up Pipedrive data](https://salesbond.app/blog/pipedrive-data-export-backup-routine/) and [how we handle a deletion request](https://salesbond.app/blog/pipedrive-gdpr-deletion-request/).

What does the buyer do with a “no”? In our experience a plain no with a compensating control gets one follow-up question. A yes that falls apart gets a security lead who goes back and re-reads every other row with new eyes. The second outcome is the one that costs the quarter. Questionnaires often arrive with a second request, and here is how to handle a [data processing agreement in a sales deal](https://salesbond.app/blog/data-processing-agreement-sales-deal/).

## Put the questionnaire on the deal

Not in the founder’s inbox, not in a Slack thread, on the deal. Pipedrive’s Files tab in the deal view takes uploads from your computer or Google Drive and keeps them with the deal through archiving, unarchiving and lead-to-deal conversion ( [Pipedrive: how to upload a file to a deal or a contact](https://support.pipedrive.com/en/article/how-can-i-upload-a-file-to-a-deal-or-a-contact)). File attachments are marked as available on every plan in Pipedrive’s plan comparison table ( [Pipedrive: plan features](https://support.pipedrive.com/en/article/what-features-do-the-pipedrive-plans-have)), so this is not a budget question.

Four things go on the deal the day the questionnaire arrives:

- The file, blank and later returned, with the return date in the filename so nobody sends an old copy to the next buyer.
- The due date as the deal’s next activity, with the owner in the subject: “Security questionnaire back to buyer, owner: Jude.”
- The blocker. If you set up the Paper blocker field from the legal and procurement article, set it to Security review. A filter on that field finds every deal waiting on a questionnaire; bulk editing updates owners or custom fields across them in one pass ( [Pipedrive: bulk editing and filtering](https://support.pipedrive.com/en/article/bulk-editing-and-filtering) ).
- A [pinned note](https://salesbond.app/blog/pipedrive-notes-mentions-pinned-handoff/) with the buyer-side reviewer’s name and the date they gave you.

One automation is worth building and no more. Pipedrive’s help says workflow automation “is only available on Growth and higher plans”, and a date trigger can fire on a deal’s date field on the exact date, before it or after it ( [Pipedrive: workflow automation](https://support.pipedrive.com/en/article/workflow-automation)). With the return date in a custom date field, a reminder a few days before it is cheap. We would not automate the answers, the follow-up email or the close date. Those are decisions.

![Illustrated deal with the questionnaire file, return-date activity and Security review blocker, plus a timeline with one close-date move](https://salesbond.app/wp-content/uploads/2026/10/sales-security-questionnaire-pipedrive-2.png)

## What to tell the buyer, and what to put in the forecast

Reply the same day, three sentences, and do not apologise for the date. Esther’s version:

“Thanks, received. Jude, who runs our infrastructure, is completing it and you will have it back by Wednesday the 14th. Two quick questions so we send the right thing: who on your side reviews it, and is this review the last step before signature or are there other steps running alongside?”

The second question is the one most teams skip, and it is the the one that fixes the forecast. It tells you whether the questionnaire is the blocker or one of several, with legal redlines queued behind it. Write the answer into the deal.

A request for an [NDA before a demo](https://salesbond.app/blog/nda-before-demo-sales-team-pipedrive/) is a blocker of the same kind, and it needs an owner and a date like any other.

Now the close date. The file goes back on the 14th. The buyer’s IT lead writes back that new vendors go to a review meeting held every other Thursday, and the next slot is the 22nd. October 30 was never going to hold. Esther moves the close date to November 13 now, once, with the reason in the note, rather than a week at a time. As we wrote in [pushed close dates in Pipedrive](https://salesbond.app/blog/pushed-close-dates-pipedrive/), one honest move is a decision and four small ones are hope. If the buyer cannot say when their review happens, you do not have a close date, you have a quarter, and the forecast category should say so rather than the date pretending.

This is where questionnaires do their quiet damage. The deal does not change stage. The close date stays where the rep left it. Activity stops, because the file is “with them”. We build SalesBond, a sales management layer on top of the CRM a team already uses; we started with Pipedrive. It reads deal data for exactly this pattern, a deal that has not moved while its close date approaches or passes with nothing scheduled, and puts it in front of the manager with the reason stated. It will not answer row 47 for you. It will stop the deal from sitting unnoticed for weeks. [Check your CRM with SalesBond](https://salesbond.app/).

## Build the answer library after the second one

Not after the first. After the first questionnaire you do not know which answers repeat; after the second you do. The same small-SaaS kit puts it at roughly 80% of questions repeating across every framework, which matches what we see: the wording changes, the question does not.

Our library is deliberately dull. One sheet, one row per question as a buyer actually phrased it, the answer, the date someone last confirmed the answer is still true, and the owner’s name. People leave out the date column, and it is the one that matters. Answers rot. “Backups are encrypted” was true in March, and the engineer who set that up left in June. So the owner re-reads the library when each new questionnaire arrives, not on a quarterly reminder nobody honours.

The kit lays out a one-week build order for its standing answers. Fair for the first build. By the third questionnaire, with the library in place, the job should be an afternoon.

Two things do not belong in it. Anything that changes with every release, because you will not keep it current. And anything that hints at a certification you do not hold. A library that hints is worse than no library, because it hints to every buyer at once.

Keep the library where the owner works, not on the deal. The deal gets the file that was sent, and it’s pinned note gets a link to the library.

## What you’ll want when the next one lands

A name, a date, a place and a file. Esther had them by Thursday evening: Jude in the answering seat, Wednesday on the activity, Security review in the blocker field, the spreadsheet in Files. And the close date moved once, with the reason written down. It took less time than reading the first tab.

The buyer’s Monday came and went. The file went back on Wednesday with eleven rows marked No, each followed by a sentence saying what the company does instead. Their IT lead asked two follow-up questions, both about rows where the honest answer was no. Neither question was a problem. The spreadsheet nobody owned would have been.