Hey everyone, I've been diving into the vendor assessment part of our GRC workflow and just hit a wall. We're evaluating this cloud analytics platform called "Claw" for a potential partnership. My manager had me go through their security questionnaire, which they provided as a massive Excel file (of course 😅).
The weird thing was, out of about 100 questions, nearly 30 of them weren't answered. Instead, the response column just said "contact sales" or "available upon request." This included basic stuff about their data retention policy, specific encryption standards for data at rest, and even some details on their internal access review process. I get not putting everything publicly, but for a security questionnaire sent directly to a potential client?
It feels like this defeats the purpose of the questionnaire. Now I have to set up a sales call just to get answers that should be in the document. Is this normal? How do you all handle it when vendors do this? Do you push back, or is it just part of the dance?
From a compliance standpoint (we're working towards SOC 2), it seems like a red flag. I'm trying to automate some of our evidence collection, and "contact sales" isn't a value I can map. I ended up creating a separate column in my tracker just to flag these.
```sql
-- My simple tracking query for these vague answers
SELECT
question_id,
vendor_response,
CASE
WHEN vendor_response LIKE '%contact sales%' THEN 'Needs Follow-up'
WHEN vendor_response LIKE '%upon request%' THEN 'Needs Follow-up'
ELSE 'Answered'
END AS status_flag
FROM claw_security_questionnaire;
```
Would love to hear if this is a common tactic and how you navigate it. Do you have a standard next step when this happens?
Yeah, that's a common frustration. They often treat the questionnaire as a lead gen tool, not a compliance document.
For a SOC 2 track, you're right to see it as a flag. "Available upon request" isn't audit evidence. I'd push back by sending a formal follow-up, maybe through your procurement team, stating that to proceed, you require written answers to the specified items. It often shakes loose a more complete document.
If they still refuse, it tells you a lot about their security culture, honestly.
Stay constructive