Sample · fictional company
Gap Memo — Northwind Analytics
31answered
1partial
3gaps
This is the page that goes back with the completed questionnaire. It lists only the rows a buyer's security team is likely to probe. Everything else is in the spreadsheet.
1.Customer SSO is not supported Expected blocker
What we said
No SAML/OIDC today. Email and password plus optional TOTP.
Why it matters
Acme is likely an Okta or Entra shop. "No SSO" is the most common reason a mid-market buyer adds conditions or delays signature.
Options, cheapest first
A. Enforce TOTP and publish the roadmap date. Free; removes the weak-auth objection, not the SSO one.
B. Add SSO via WorkOS or Auth0 Organizations — 2–3 weeks, ~$150–500/mo. Turns a blocker into a checkbox.
C. Contractual commitment: "SSO available by [date]" as a condition of the contract.
B. Add SSO via WorkOS or Auth0 Organizations — 2–3 weeks, ~$150–500/mo. Turns a blocker into a checkbox.
C. Contractual commitment: "SSO available by [date]" as a condition of the contract.
Owner / target
Head of Engineering · decision by 2026-11-17
2.No third-party penetration test Medium risk
What we said
No test yet. Continuous AWS Inspector scanning, Dependabot, manual review of auth code. Third-party test budgeted for Q1 2027.
Why it matters
Buyers accept "no pen test" far more readily than a blank. The risk is a follow-up asking for a report that doesn't exist.
Fix
Book a scoped external test now — a 5-day web app test runs roughly $3,000–8,000 and takes 2–4 weeks to schedule. Ask the buyer whether an in-progress test is acceptable as a condition.
Owner / target
Head of Engineering · provider booked by 2026-11-30
3.No formal background checks Low risk · easy win
What we said
No background checks. NDA and role-based access instead.
Why it matters
Rarely a blocker at 14 people, but it looks negligent when left blank in later questionnaires.
Fix
Use a provider (Checkr, Zinc, or a local equivalent) for new hires. ~$30–60 per hire. Retrospective checks on existing staff are usually not worth it.
Owner / target
Operations · provider selected by 2026-12-15
4.On-call is best-effort Note only
What we said
Alerts to Slack and PagerDuty, one-hour acknowledgement during business hours.
Why it matters
A 24/7 buyer may ask about out-of-hours response. The answer is honest and proportionate for this size — leave it.
If pushed
Offer a contractual support window and an escalation contact rather than promising coverage the team can't staff.
What was deliberately not claimed
- No SOC 2, ISO 27001 or PCI DSS — Northwind holds none of these.
- No SIEM — cloud-native logging plus alerting was described as it is.
- No 24/7 on-call.
- No encryption of internal VPC traffic, because it isn't encrypted.
A gap that is disclosed is a condition. A gap that is discovered is a lost deal and a contract problem. That distinction is the whole service.