Vendor Security Assessment Checklist: What Enterprise Teams Actually Evaluate

You’ve closed the deal verbally. The champion is ready to sign. Then comes the email: "Please fill out this security questionnaire and attach your latest SOC 2 report for our TPRM team."

Suddenly, your 30-day close becomes a 90-day slog.

Enterprise vendor security assessments are not just about checking a box. For deals over $50k, security teams (TPRM - Third-Party Risk Management) actually read the documentation. They are looking for specific red flags that indicate operational immaturity or liability risk.

If you are a B2B SaaS founder or CTO, you need to know exactly what the person on the other side of that spreadsheet is looking for. This article outlines the actual evaluation criteria enterprise security teams use to approve—or kill—your vendor application.

The "Big Three" Artifacts You Cannot Skip

Before a security engineer even opens your questionnaire, they look for three specific documents. If these are missing or outdated, you likely won't pass the initial triage.

1. SOC 2 Type 2 Report (Not Type 1)

For enterprise deals, a SOC 2 Type 1 is often considered a "learner's permit." It proves you designed controls at a specific point in time. Enterprise teams want a SOC 2 Type 2, which proves those controls operated effectively over a period (usually 6-12 months).

What they check inside the report:

The Opinion: Is it "Unqualified" (clean) or "Qualified" (issues found)? A qualified opinion isn't an automatic fail, but you must have a remediation plan ready.
Exceptions: They flip straight to Section 4 to see if your controls failed during testing. If you had exceptions around offboarding employees or background checks, expect follow-up questions.
The Bridge Letter: If your report is more than 3 months old, they will demand a "bridge letter" (or gap letter) stating that no material changes have occurred since the audit period ended.

2. Penetration Test Report (Summary Only)

They do not want the full report with raw vulnerability data. They want the executive summary and the attestation of remediation.

What they evaluate:

Date: Must be within the last 12 months.
Scope: Did you test the actual application they are buying, or just your marketing site?
Findings: Are there open "Critical" or "High" vulnerabilities? If yes, the deal is paused until you fix them and get a re-test validation.

3. Cyber Insurance Certificate (COI)

This is a financial control, not a technical one. Procurement teams usually require specific coverage limits before Legal will approve the contract.

Typical requirements:

Technology E&O (Errors & Omissions): usually $1M - $5M depending on deal size.
Cyber Liability: usually $1M - $5M.

What Do Security Teams Actually Look For in the Questionnaire?

Once the artifacts are cleared, they scan your SIG Lite, CAIQ, or custom spreadsheet. They are not reading every answer. They are scanning for these specific deal-breakers.

Do You Encrypt Data in Transit and at Rest?

"Yes" is the only acceptable answer.

At Rest: AES-256 (usually via AWS/GCP default encryption settings).
In Transit: TLS 1.2 or higher.

The hidden trap: If you support legacy clients using TLS 1.0/1.1, you will get flagged.

How Do You Handle "Fourth-Party" Risk?

You are a third-party vendor to them. Your vendors (AWS, OpenAI, Twilio) are "fourth parties." Enterprise teams want to know if you review your vendors.

The question: "Do you review the security of your sub-processors annually?"
The evidence: They may ask for your Vendor Risk Management policy or a list of your critical sub-processors.

Do You Commingle Data?

In multi-tenant SaaS, data isolation is the primary concern.

Logical Isolation: Do you use unique org_id keys in every database query?
The "Red Flag" Answer: "We separate data via frontend logic." (This is an immediate fail).
The "Gold Standard" Answer: Row-level security (RLS) in Postgres or separate schemas/databases for high-value tenants.

What Is Your SDLC (Software Development Life Cycle) Security?

They want to know you aren't pushing code directly to production from a laptop.

Required: Pull requests require at least one peer review.
Required: CI/CD pipeline runs automated tests (SAST/DAST) before deployment.
Required: Production access is restricted to a small group of engineers (not the whole team).

Where "Check-the-Box" Compliance Fails

Founders often assume that having Vanta or Drata means they are "done." But automated platforms often miss the nuanced operational evidence that enterprise auditors dig for.

Evaluation Area	Automated Platform Check	What Enterprise Humans Actually Check
Background Checks	"Policy exists"	"Did you background check the contractor in Brazil who has prod DB access?"
Access Control	"MFA enabled on Google Workspace"	"Is MFA enabled on the obscure marketing tool that integrates with your CRM?"
Incident Response	"Policy document signed"	"Show me the post-mortem of your last tabletop exercise."
Pen Testing	"Vendor engagement letter uploaded"	"Did you actually fix the High severity findings, or just mark them as 'Risk Accepted'?"

The "Sub-Processor" Trap

This is the most common reason for delays in 2025.

Under GDPR and CCPA, enterprises are legally liable for where their data goes. If you use a sub-processor (e.g., an AI API wrapper or a niche analytics tool) that hosts data in a non-compliant jurisdiction or has weak security, the enterprise cannot legally sign with you.

The Fix: Keep your sub-processor list short, reputable (AWS, Stripe, OpenAI, etc.), and public (on your Trust Center). If you use a small, unknown startup as a sub-processor, be prepared to defend their security posture as if it were your own.

How to Speed Up the Review Process

You cannot skip the review, but you can shorten it.

Build a Trust Center: Use a tool (or a simple public notion page) to host your SOC 2 Type 2 bridge letter, Pen Test summary, and pre-filled standard questionnaires (SIG Lite or CAIQ).
Pre-Fill a SIG Lite: The Standardized Information Gathering (SIG) questionnaire is the industry standard. Fill it out once, accurately, and offer it immediately: "We have a completed SIG Lite ready to go—will that suffice instead of your custom sheet?" 60% of the time, they say yes.
Automate Evidence Collection: When they ask for proof (e.g., "Show me a screenshot of your AWS S3 bucket encryption settings"), don't scramble. Use tools that capture this continuously so you can drag-and-drop the evidence immediately.

Learn More About SOC 2 for Bootstrapped SaaS

The foundation of passing any enterprise security review is a clean SOC 2 report. For a realistic look at costs and timelines without the sales fluff, read our bootstrapped founder's guide to SOC 2.