Blog · Sales and security · Problem 13 of 93
Sales promised the buyer a security feature you don’t have. Again.
· 3 min read · By Case Jones
A deal closed, and the contract lists single sign-on, data residency or “annual penetration tests”. Nobody on the product or security side was asked. Now engineering has a deadline, and security has a promise to keep.
What it costs to leave it
A promise made in a sales call can end up in the contract and the security questionnaire, and then it’s an obligation. Missing it means credits, an unhappy renewal or a breach of contract. Bluffing once also teaches buyers not to trust your next answer.
How to give sales true answers they can use
Sales usually over-promises because the honest answer is hard to find, not because people want to mislead. Make the true answer easier to reach than a guess.
- 1
Write down what you actually have
One page: the security features and practices you have today, each in a sentence a buyer understands. Single sign-on, encryption, backups, where data lives, who can access it. Keep it current, and keep it where sales already looks.
- 2
List what you don’t have, and what to say instead
For each common request you can’t meet yet, write the honest answer and the nearest thing you do have. “We don’t offer SAML yet; we support Google and Microsoft sign-in with enforced MFA” keeps the conversation going.
- 3
Agree what needs a security check
Some promises always need a second pair of eyes: certifications, data location, uptime numbers, penetration tests, response times for incidents. Sales can promise these only after security says yes in writing.
- 4
Check the contract against the policies
Before signing, compare the security terms in the contract with what your policies say. If a clause asks for more than you do, change the clause, or plan the work and its date before the deal closes.
- 5
Treat a roadmap item as a roadmap item
“Planned for next quarter” is not “we have it”. If you share a plan, say so in writing, and don’t let it become a contractual requirement unless the team has committed to the date.
Example
An honest answer that still sells
Buyer: “Do you have a SOC 2 report?” Before: “Yes, we’re SOC 2 compliant.” After: “Not yet. Our policies are written against SOC 2, we can share them under NDA, and we can answer your questionnaire in detail today.”
Or let 93 Compliance keep the answers honest
Paste a buyer’s security questionnaire and each question is tested against your policies and risks: green for what you have, yellow for what’s thin, red for what’s missing. Sales sees the true answer before anyone types it, and answers can be drafted and kept for next time.
Missing policies can be written in the policy builder with an AI policy assistant, as tracked changes an owner accepts. Discovery also compares what your website claims with what your policies say.
All of this is free, with no card.
- Questionnaires checked green, yellow or red against your policies
- Answers drafted and kept for the next buyer
- Website claims compared with your policies
- Missing policies drafted in the policy builder
Check a questionnaire
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Should sales see the security policies?
Yes, a short summary of what you have and don’t have, kept current. Sales can’t give true answers without them.
What if a big deal depends on a feature we don’t have?
Say so, offer what you do have, and if the business decides to build it, put the plan and date in writing before it goes into the contract.
Who should approve security terms in a contract?
Whoever owns security, before signature. Certifications, data location, incident response times and testing commitments should never be agreed by sales alone.