A startup that wants to sell to large companies does not need a certification on day one. It needs a sequence: first, answer customers' security questionnaires consistently and truthfully; then, have basic controls that are documented and actually work; finally, decide whether and which formal attestation to obtain, based on the markets you sell into. Skipping the first two steps to go straight for a certificate usually costs more and holds up less well. This is a practical roadmap for building enterprise readiness without stalling the product.
In short
- Enterprise customers assess suppliers through questionnaires, contract clauses and, sometimes, certification requirements.
- NIS2 requires in-scope entities to manage supply chain security: that is why the questions reach you too.
- Start from a set of standard answers and a few real controls: strong authentication, backups, access management, incident handling.
- ISO/IEC 27001 and SOC 2 are two different routes; the choice depends on your customers and markets.
- Never claim controls in a questionnaire that you do not have.
Why the questionnaires arrive
Among the risk-management measures in Article 21 of the NIS2 Directive is supply chain security, including security-related aspects of relationships with direct suppliers. The same article asks entities to take into account the vulnerabilities specific to each direct supplier and the overall quality of their suppliers' products and cybersecurity practices.
For a startup this means that even if you are not directly in scope of NIS2, your customers who are will ask you to show how you manage security. They will do it with questionnaires, contract annexes, requests for evidence and sometimes audits. If you process personal data on your customers' behalf, add the processing agreement required by Article 28 of the GDPR, which among other things requires appropriate security measures and rules for sub-processors.
Phase 1: a base of true answers
The first goal is to stop improvising every time. Collect the questionnaires you have received, including from prospects, and prepare a standard-answers document covering the recurring topics. A good outline is the list of measures in NIS2 Article 21(2):
- policies on risk analysis and information system security;
- incident handling;
- business continuity, backup, disaster recovery and crisis management;
- supply chain security;
- security in acquiring, developing and maintaining systems, including vulnerability handling;
- assessing the effectiveness of the measures;
- basic cyber hygiene and training;
- cryptography and, where appropriate, encryption;
- human resources security, access control and asset management;
- multi-factor or continuous authentication and secured communications.
For each topic, write precisely what you do today, and what you plan to do and when. An answer such as "being implemented, completion expected this quarter" is acceptable; a false answer is not, and it can surface in an audit or after an incident.
Phase 2: a few real, documented controls
The second step is making the answers that matter most true. For a small startup the priorities are usually:
- multi-factor authentication on email, code repositories, cloud and admin tools;
- access management: who has access to what, periodic review, prompt removal when someone leaves;
- backups tested with an actual restore, not just configured;
- vulnerability management: updates, dependencies, a way to receive reports;
- an incident procedure: who decides, who informs customers, within which contractual timelines;
- a supplier inventory of those who process data or have access to your systems.
Document each control on a short page: what it does, who owns it, how it is checked. These documents become the evidence you attach to questionnaires and the foundation for any later certification.
Phase 3: choose the right attestation
When customers start requiring a certification, it is time to choose. The two most common routes differ in nature.
- ISO/IEC 27001:2022 is the standard for information security management systems. It defines the requirements a management system must meet and covers risk management and continual improvement. Certification is optional: organisations applying the standard decide whether to go through a certification process.
- SOC 2 is an attestation report issued by auditors (CPAs) on the controls of a service organisation, covering the categories security, availability, processing integrity, confidentiality and privacy. The framework is published by the AICPA.
As a practical rule, look at where the customers asking for an attestation are based and what exactly their contracts require. If they are not asking, there is no rush: a solid Phase 2 answers many questionnaires. Before starting any programme, get estimates of time and cost from several consultants and bodies.
How to organise the work
- Name an internal owner, even part-time, for questionnaires and documentation.
- Keep a log of customer requests: what they asked, what you answered, what you committed to.
- Review the standard answers at least every six months or after any major infrastructure change.
- Involve the people who build the product: many answers depend on technical choices.
What to do in the next 90 days
- Collect every questionnaire and security clause you have received so far.
- Prepare a standard-answers document organised around the NIS2 Article 21 measures.
- Turn on multi-factor authentication everywhere and review access.
- Test a full restore from backup and document it.
- Write the incident procedure and the supplier inventory.
- Prepare a GDPR Article 28 processing agreement template.
- Decide whether a certification is needed by reading your customers' contracts; to talk it through, get in touch.
You will find templates and checklists in Resources.
Sources
- NIS2 Directive, Article 21
- ISO, ISO/IEC 27001:2022
- AICPA-CIMA, System and Organization Controls (SOC)
- GDPR, Article 28
This article is general guidance and does not replace a compliance assessment of your specific case.
Subscribe to Dispatch, the PATAVIUM newsletter, for updates on regulation, security and tools for your startup.