Your champion says yes. Then their security team sends you a vendor security assessment, a spreadsheet of questions, and the deal waits until you send it back. If your company was founded outside the US, we would expect a few of those questions every time, and you can publish the answers before anyone asks.
This post is for marketing and revenue leaders at Israeli-founded software and security companies selling to US enterprises. It explains what the review is for, the questions we would expect a foreign-founded vendor to get, and which answers belong on your website instead of in a reply-all thread.
What a vendor security assessment is for
Start on the buyer’s side.
NIST wrote a category just for suppliers into CSF 2.0, its Cybersecurity Framework. One of its outcomes reads: “Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships.” The next one says supplier risks are “monitored over the course of the relationship.”
So if your buyer works from CSF 2.0, nobody forgot to cancel the review. Their team is doing the due diligence that sentence asks for. And it does not end at signature, which is worth knowing before you write your answers.
The AICPA describes the same need from the auditor’s side. Customers “usually need information about the design, operation, and effectiveness of controls” at a service provider, and to get it they “often request a SOC 2 report from the service organization.” If you have one, we would expect it to cover a good part of the questionnaire. If you do not, those questions land on people at your company.
The four questions a foreign-founded vendor should expect
Expect the core control questions wherever you were founded. A company founded abroad should plan for a few more, and in our view they are mostly not about technology. Here is what we would prepare for.
Who signs the contract. The reviewer wants to know which legal entity they are buying from, where it is registered, and which entity holds their data. If your US subsidiary sells and your parent company runs engineering, say so plainly. We would expect a vague answer here to send the question to legal, which adds another round of review.
Where the data lives, and who can reach it. Expect two questions that sound like one. Where is customer data stored and processed? And from which countries can your people access it? Engineering in Tel Aviv and hosting in Virginia can be a perfectly sound setup. It still has to be written down, with the access controls next to it.
Who answers at 3 a.m. Eastern. NIST lists another outcome in the same category: suppliers “are included in incident planning, response, and recovery activities.” A reviewer reads that as a question about you. What are your support hours in US time zones? Who is on call during an incident, and how fast do they notify the customer? A time difference is fine. Silence about it is not.
What your certifications actually cover. The AICPA says a SOC 2 report looks at the controls in a service organization’s system. So we would expect a reviewer to check whether that system includes the product they are buying and the entity they are signing with. If your audit covers the parent company and the platform, and the US entity resells it, explain the link in one paragraph.
The frameworks behind the questions are public
You can prepare for much of the review in advance, because the frameworks a questionnaire can draw on are public.
Take the Cloud Security Alliance. Its Cloud Controls Matrix “is composed of 197 control objectives that are structured in 17 domains.” Its questionnaire, the CAIQ, documents “what security controls exist in IaaS, PaaS, and SaaS services.” NIST’s supply chain category, by comparison, includes ten outcomes. Your buyer might work from one of these, from a commercial questionnaire, or from a spreadsheet of their own.
The practical point: if the same questions come back deal after deal, you can write the answers once. If you answer them from scratch, under deadline, for each buyer, that is the delay your champion sees. It is also the part you control.
Why marketing should publish the answers first
In the split we would suggest, security owns the answers. Marketing owns where buyers read them before they ever send a questionnaire.
Think about who might look at your site during a deal, starting with your champion, who may want something reassuring to forward to their security lead. That lead may search your name plus “SOC 2” before the kickoff call. And procurement? They may just want the legal entity and an address. If each of them finds a clear page, the questionnaire arrives after the buyer has already found half the answers. If they find a logo wall and a “contact us”, they start from zero and so do you.
There is a public precedent. The CSA runs the STAR Registry, which it describes as “a publicly accessible registry that documents the security and privacy controls provided by popular cloud computing offerings.” Its stated purpose is to let companies “show current and potential customers their security and compliance posture.” So publishing your answers has a public model to follow. It is not oversharing.
| Question | What we would publish | What we would provide only on request |
|---|---|---|
| Who signs the contract | Legal entities, where each is registered, which one contracts with US customers | Corporate documents, insurance certificates |
| Where data lives | Hosting regions, subprocessors, which countries staff access data from | Network diagrams, detailed access lists |
| Support and incidents | Support hours in US time zones, incident notification commitment | The full incident response plan |
| Certifications | Which reports and certificates you hold, the date, and what each one covers | The SOC 2 report itself, pen test summaries |
What remains available on request
Publishing first does not mean publishing everything.
We would keep the SOC 2 report itself behind a short request form, and say on the page that it exists, when it was issued and how to get it. The same goes for penetration test summaries and anything that maps your internal network. In our view a buyer needs to know these documents exist and are current. They do not need them before they have a reason to ask.
The test we would use: if a competitor read the line, could they use it against you? “Our US entity is the contracting party and we offer support from 8 a.m. to 8 p.m. Eastern” helps a buyer and gives a rival nothing. Your control-by-control audit results are the opposite.
Who owns the page
This is where we would expect the work to stall. In many companies we would expect security to have the facts and no time to write. Marketing has the time but no authority to make claims about security controls.
The split we would suggest: security writes or approves every factual line, legal approves the entity paragraph, and marketing owns the page, the wording and the date at the top. Put a “last reviewed” date on it and mean it. CSF 2.0 has supplier risk monitored “over the course of the relationship,” so a page that was true at launch and stale a year later can become a finding of its own.
Tie the review to an event you already have. Your annual audit is the obvious one. When the new report is issued, the page gets updated the same week.
Where to start
We would not wait for a full trust center. We would start with three things.
- A security page that answers the four questions above in plain sentences, with a date.
- A pre-filled answer set for the common questionnaire you see most often, kept by security and handed to sales, so a reply never starts from a blank sheet.
- A line in your sales process: when a deal reaches the security review, the rep sends the page and the answer set before the buyer asks.
None of this replaces the validation a security buyer may do earlier, during evaluation. We cover that in our guide to cybersecurity marketing, and the steps around it in the B2B buyer journey. If you are building US demand from Israel, this piece on the US and home-market split sets up the rest. And if the review is where your deals keep slowing, it belongs in your demand generation plan, not only your security team’s backlog. Our cybersecurity marketing work starts from the same question: what does the buyer need to read before they say yes?
FAQ: vendor security assessment
What is a vendor security assessment?
It is a review a buyer’s security team can run on a supplier before signing: a questionnaire, document requests, or both. One NIST CSF 2.0 outcome calls for due diligence “to reduce risks before entering into formal supplier or other third-party relationships.”
Does the buyer only send a questionnaire?
Not always. In a vendor security assessment we would also plan for document requests, such as a SOC 2 report or a certificate, and follow-up calls with your security team.
Who usually sends the questionnaire?
We would expect it from the buyer’s security or third-party risk team, sometimes after procurement opens a vendor record. If your champion did not write it, they cannot answer it for you either.
Does a SOC 2 report replace the questionnaire?
Not fully, in our view. The AICPA says customers often request a SOC 2 report to get information about a provider’s controls. We would still expect questions about scope, legal entity, data location and support.
Should a security vendor publish its SOC 2 report?
We would publish that you have one, the date and what it covers, and keep the report behind a short request form. The detail inside helps a buyer who is evaluating you and could help an attacker who is not.
What extra questions does a foreign-founded vendor get?
In our view, four: which legal entity signs and holds the data, where data is stored and from which countries staff can reach it, support and incident coverage in US time zones, and whether your certifications cover the entity and product being sold.
What is the CAIQ?
The Cloud Security Alliance publishes it. CAIQ is short for Consensus Assessment Initiative Questionnaire. The CSA says it documents “what security controls exist in IaaS, PaaS, and SaaS services.” Companies can publish a completed one in the CSA STAR Registry.
How often should the public answers be updated?
We would update them at least when your audit report is reissued, and whenever an answer changes: a new hosting region, a new subprocessor, new support hours. Put a review date on the page so buyers can see it is current.
COSEOM Team
COSEOM is a multilingual B2B growth agency. Since 2008 the COSEOM team has run international SEO, generative engine optimization, paid media and demand generation programs for B2B software and technology companies across their target markets. We publish our research, playbooks and product guides here. More about COSEOM
