Blog · Small teams · Problem 11 of 93
You’re two founders. The questionnaire asks about your security team.
· 3 min read · By Case Jones
The two of you write the code, answer support and close the deals. Now a bigger company’s questionnaire asks who your CISO is, how your security team is organised and how duties are separated.
What it costs to leave it
Pretending to have a team you don’t have is the fastest way to lose trust when it comes out, and it usually does. Saying “we’re too small for that” loses the deal another way. The buyer doesn’t need a big team. It needs to see that someone owns security and that the basics are done.
How to answer as a small team without bluffing
Buyers deal with small vendors all the time. What they look for is ownership, written rules, and checks that don’t depend on one person’s memory.
- 1
Name a security owner
One founder takes the security role, by name and title. “Our CTO is responsible for security” is a real answer. You don’t need a full-time CISO to have someone accountable.
- 2
Write down what you actually do
Two people still make decisions: who gets production access, how backups work, what happens when a laptop is lost. Write those down as short policies. Short and true beats long and copied.
- 3
Separate duties where it matters most
With two people, full separation is impossible, but the main points still work: code changes reviewed by the other person, production access granted by one and checked by the other, and access reviews signed off by someone who didn’t grant it.
- 4
Lean on your providers honestly
Your cloud host runs the data centre, the physical security and much of the network. Say so, and say what you configure on top. Don’t borrow their certifications as yours.
- 5
Say what happens as you grow
A sentence like “we will add a dedicated security role as the team grows” shows you’ve thought about it. Buyers respect a plan more than a promise.
Example
An honest answer to “describe your security team”
“We are a team of two. Our CTO is responsible for security. Policies cover access, change management, backups and incident response. Every production change is reviewed by the other founder, and access is reviewed quarterly by the person who didn’t grant it.”
Or start with 93 Compliance
The policy builder works out which documents a company like yours needs, and the AI policy assistant writes them to fit what you actually do, as tracked changes for an owner to accept. Word downloads are free.
Procedures turn the rules into checklists with evidence, and a check can’t be signed off by the person who did the work. That’s separation of duties a two-person team can show.
Paste the buyer’s questionnaire to see which answers you can already support and which you can’t, green, yellow or red. All of this is free, with no card.
- The policies a small company actually needs
- Checklists where the other person signs off
- The questionnaire checked against your real practice
- Free Word downloads
Build our policies
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Do we need a CISO?
Not as a separate hire. Buyers want to know who is responsible. A founder or CTO with the security role written into their job is a normal answer for a small company.
How do two people separate duties?
By making sure the person who does something isn’t the only one who checks it. One writes the change, the other reviews it; one grants access, the other reviews it.
Will being small lose us the deal?
Rarely on its own. Vague or inflated answers do more damage. A short, true answer with written policies behind it is what most reviewers want.