Learn
Playbook
A security questionnaire from a prospective customer can land in a founder’s inbox with detailed questions about encryption, access controls, incident response and data retention. It usually comes with a tight deadline. If you run a small company without a dedicated security hire, the honest answer to most of those questions is: you’re not sure. The good news is that you don’t need a security team to answer well. You need accurate records of what Google Workspace already does for you, a clear map of your third-party app access and a documented process for the handful of things you control directly. This guide walks through exactly how to build that, using tools most small businesses already have.
TL;DR
Most security questionnaires map to a small set of recurring frameworks (SOC 2, ISO 27001, NIST CSF, SIG, CAIQ), so learning the pattern once saves time on every future questionnaire.
Google Workspace already provides a meaningful security baseline, including 2-Step Verification, anti-phishing and anti-malware protections and Data Loss Prevention (depending on your edition), plus Google’s published compliance documentation (SOC 2, ISO 27001, HIPAA support) for infrastructure questions.
The biggest gap for small businesses is usually visibility into third-party app permissions, not core infrastructure security.
Keeping answers and evidence documented before a questionnaire arrives turns the response from a scramble into a routine task.
Platforms made for Google Workspace, like ShiftControl, give a founder or ops lead the app-permission visibility and access records that support their own answers, without hiring a security specialist.
What Is a Security Questionnaire, and Why Does It Land on an Operator’s Desk?
A security questionnaire is a standardized list of questions a customer or partner sends a vendor to evaluate its security and privacy posture before signing a contract. It typically shows up during procurement, right after commercial terms are agreed but before a contract is signed, which means it can quietly stall a deal if nobody owns the response.
At a company with a security or compliance team, this work gets routed to a specialist who already has answers on file. At a small business, it usually lands on whoever is closest to IT: a founder, an operations lead or a CTO wearing five hats. That person often doesn’t have a wrong answer so much as no centralized place to find the right one. The questions aren’t usually about advanced attacks. They’re about whether you can prove ordinary good practice: who has access to what, how you remove access when someone leaves and what happens if something goes wrong.
What Frameworks Do These Questionnaires Actually Reference?
Security questionnaires are rarely invented from scratch. Most pull their structure from a small number of established frameworks, and recognizing which one you’re looking at tells you immediately what kind of evidence you need.
The most common frameworks referenced in security questionnaires are SOC 2, ISO 27001, the NIST Cybersecurity Framework, SIG (Standardized Information Gathering) and CAIQ (Consensus Assessments Initiative Questionnaire). Even a customer-written questionnaire is usually adapted from one of these.
A quick reference:
Framework | What it’s checking | Typical question style |
|---|---|---|
SOC 2 | Access control, change management, monitoring | “Describe your access review process” |
ISO 27001 | Information security management system | “Do you have a documented security policy?” |
NIST CSF | Govern, identify, protect, detect, respond, recover | “How do you detect unauthorized access?” |
SIG | Broad vendor risk categories | Long checklist across many risk areas |
CAIQ | Cloud-specific controls | “Where is customer data physically stored?” |
Once you know which framework a questionnaire follows, such as SIG, you can reuse the same evidence set across future questionnaires instead of starting over each time.
What Can You Honestly Answer Using Google Workspace Alone?
Most small businesses underestimate their starting position. Many question categories map to controls you already have.
Google Workspace provides a real security baseline out of the box: 2-Step Verification, built-in anti-malware and anti-phishing protections and Data Loss Prevention (availability depends on your Workspace edition). Just as importantly, Google publishes its own compliance documentation for SOC 2, ISO 27001 and HIPAA support, so you don’t need a security team to produce that infrastructure evidence from scratch.
This matters because a large share of questionnaire sections (encryption in transit and at rest, data center physical security, uptime guarantees) are really questions about your infrastructure provider, not about you. If your email, calendar and document storage run on Google Workspace, you can answer those sections by referencing Google’s published compliance documentation rather than producing your own.
Regulatory obligations layer on top of this baseline depending on your customers and industry:
GDPR applies if you handle personal data of EU residents, covering how personal data is collected, processed and transferred.
HIPAA applies if you handle Protected Health Information, which requires signing a Business Associate Agreement (BAA) with Google.
SOC 2 readiness, for startups pursuing their own attestation, is easier when access controls and audit logs in Workspace are already configured and documented.
This is useful ground for startups preparing for a first SOC 2 audit. You’re configuring and documenting controls that already exist in your platform.
What’s the Actual Gap Most Small Businesses Have?
Google’s baseline stops where your own responsibility starts, and the gap is third-party app permissions.
Third-party apps often request OAuth scopes that exceed actual business requirements, particularly those asking for broad read and write access to Gmail, Drive and Calendar. Apps that fall out of active use also frequently retain persistent access long after they’re needed. This is the section of a questionnaire where “we use Google Workspace” isn’t a sufficient answer, because the question is really asking what else has access to the data inside it.
An employee connecting a scheduling tool or a marketing app to their Google account for a free trial, then forgetting about it six months later, is a normal workday action, not a security failure on its own. But multiply that across a growing team and you get a sprawling, invisible list of apps with standing access to company email and files. This is the kind of risk a customer’s security team is specifically probing for when they ask how you vet vendors and manage third-party risk, because your vendors’ access to your systems becomes a risk to their data by extension.
How Do You Build a Repeatable Process Instead of a One-Time Scramble?
Answering one questionnaire well is useful. Building a process means the next one goes much faster. Treat each questionnaire as an addition to a living file rather than a fresh project.
A workable process looks like this:
Keep a master answer document. Record one canonical answer per common question, update it quarterly and pull from it every time.
Maintain a current app inventory. List every third-party app with Google Workspace access, what data it can touch and whether it’s still in active use.
Document your offboarding process in writing. “We revoke access on the day someone leaves” is only credible if you can show the process that enforces it.
Keep an incident response plan on file, even a short one, naming who gets contacted and what the first steps are.
Review access quarterly, not just when a questionnaire forces you to.
This is the functional core of compliance for small business: not hiring a compliance officer, but keeping a small number of artifacts current and ready to hand over.
Response is slow mainly because teams rebuild the same answers and the same evidence every time. Documentation ready before the questionnaire arrives, not after, fixes that.
ShiftControl is made for Google Workspace. It shows an operator every app and OAuth scope connected to the Workspace, and it exports app assignments and authorization history as downloadable, audit-ready access reports, which can support your answers where Google’s own compliance documentation doesn’t reach. You still write and own the answers. It sets up in as little as 10 minutes by signing in with Google Workspace admin single sign-on, so you need admin access, not deep IT expertise.
Incident response is the other section that trips up small teams, because many questionnaires ask for a named plan, not just a policy statement. Cyber incident response (IR-1, via Blackpanda) is included in every ShiftControl subscription, not a separate add-on. The incident response plan itself is still yours to write.
Frequently Asked Questions
Do I need a security certification to answer a customer’s security questionnaire?
No. Most small businesses answer honestly by describing their actual controls and referencing their infrastructure provider’s compliance documentation. A certification can help with larger enterprise deals later, but it isn’t a prerequisite for responding well.
What’s the difference between a vendor risk assessment and a security questionnaire?
A vendor risk assessment is the customer’s internal process for evaluating a vendor; the security questionnaire is the primary tool used within that process to gather evidence from you.
Is SOC 2 required to win enterprise customers?
It depends on the customer. Some enterprise buyers require it, others accept a well-documented set of controls plus a plan to pursue SOC 2. Starting with strong access control and audit log practices in Google Workspace puts you ahead either way.
How often should I update my master questionnaire answers?
Quarterly at minimum, and immediately after any change to your app stack, offboarding process or incident response contacts.
Can Google Workspace alone satisfy HIPAA requirements?
Only with a signed Business Associate Agreement from Google and your own internal controls around how Protected Health Information is handled. Google’s infrastructure compliance doesn’t cover how your team uses the platform.
What’s the single biggest point of failure for small businesses in these questionnaires?
Third-party app permissions. Many teams can describe their own practices confidently but have no current inventory of what external apps can access their Workspace data.
Do I still need to read every questionnaire carefully?
Yes. A master answer document removes the repetitive work so you can focus your attention on questions specific to that customer’s risk profile.
About ShiftControl
ShiftControl is an IT operations and SaaS management platform made for Google Workspace, giving small and growing businesses access control, SaaS spend visibility, app-permission visibility and incident response in one place. It includes cyber incident response (IR-1, via Blackpanda) in every subscription. ShiftControl is SOC 2 Type 2 compliant and ISO 27001 certified. It signed the CISA Secure by Design Pledge in 2024.
If the next security questionnaire is already sitting in your inbox, start a 14-day free trial (no credit card required) or book a demo to see what a platform made for Google Workspace looks like.
