When a company starts selling to larger customers, the security review stops being a formality. Procurement, legal and security teams usually ask for evidence of controls, not just polished answers.
Core idea: if you cannot demonstrate the control, enterprise buyers may treat the control as not existing yet.
Minimum evidence that commonly appears
- MFA for critical accounts and privileged users.
- Access, incident response, backup, retention and vendor policies.
- Inventory of relevant systems, data and third parties.
- Backups and evidence of restore tests.
- Logs, monitoring and review process.
- Development security: dependencies, secrets, changes and releases.
- AI use: data touched, providers, retention and guardrails.
How to answer without improvising
Separate existing controls, documented but unevidenced controls, missing controls and out-of-scope controls. An evidence tracker helps turn the security review into owners, proof, gaps and dates.
Warning signs
- Answering “yes” without evidence.
- Copied policies nobody operates.
- Not knowing which providers process data.
- No recent restore test.
- Not being able to explain AI use with internal data.