customer number three sent a 74 question security questionnaire and wants a signed dpa - answer it or walk

Answer it, honestly, and do not pretend. Reviewers see a lot of these and an inflated one is obvious and fatal. A clean no with a sentence explaining what you do instead reads as competent. A yes you cannot evidence reads as a liability.

So for background checks: no, single person company, here is the identity verification my payment provider ran. For penetration testing: no third party test, here is what I do use, here is my dependency scanning, and I am open to their test at their cost. For business continuity: honestly describe the backup schedule, the restore procedure and the last time you tested a restore. If the answer to that last one is never, go test a restore before you send the spreadsheet back, because it is the question that most deserves a real answer.

The DPA itself is usually the easy part. Their template, your subprocessor list, a review by someone who reads contracts.

Do not sign a DPA with unbounded liability, and do not agree to a breach notification window you cannot physically meet while holding down another job. Those two clauses are where the actual risk lives, not in the encryption questions everyone focuses on.

One more: check whether they expect you to carry insurance. It shows up buried in the contract rather than the questionnaire, and for a one person software vendor it is usually obtainable and not enormous, but it is a line item you should price into the deal before you agree rather than discover afterwards.

Disagreeing with the enthusiasm slightly. Two days of your time on a $1,068 contract is a bad trade on its own terms, and it only makes sense if you believe this segment is where the product is going.

Ask the champion directly: is this the standard process for any vendor, or is it triggered by the data we would be handling. Sometimes there is a lightweight path for small spend that procurement did not offer because nobody asked. I have had a 74 question form reduced to eight by one email asking whether the low-value vendor process applied.

And if they will not move, be willing to walk. Some companies genuinely cannot buy from a one person vendor, and finding that out in week one is a gift.

Formal audit reports at this stage are not worth it. The cost and the time are real and the return only appears when several deals a quarter are stalling on the same missing document. Wait until you can point at pipeline that is blocked by it. Until then, a good security page and honest answers get you a surprising distance.

Do it once properly and it becomes an asset. Put your answers into a single security page on your own site - architecture, where data lives, encryption in transit and at rest, subprocessor list, retention and deletion, how to report a vulnerability, and what you do not have.

After I did that, roughly half of subsequent questionnaires were answered by sending the link plus a short document covering the gaps. The first one took me two full days. The fifth took forty minutes.

Also ask whether they will accept your completed copy of a standard questionnaire format instead of their bespoke spreadsheet. Some procurement teams will, and it means you fill in one document forever rather than a new one per customer.