Hey everyone, I've been diving into the vendor assessment part of our GRC workflow and just hit a wall. We're evaluating this cloud analytics platform called "Claw" for a potential partnership. My manager had me go through their security questionnaire, which they provided as a massive Excel file (of course 😅).
The weird thing was, out of about 100 questions, nearly 30 of them weren't answered. Instead, the response column just said "contact sales" or "available upon request." This included basic stuff about their data retention policy, specific encryption standards for data at rest, and even some details on their internal access review process. I get not putting everything publicly, but for a security questionnaire sent directly to a potential client?
It feels like this defeats the purpose of the questionnaire. Now I have to set up a sales call just to get answers that should be in the document. Is this normal? How do you all handle it when vendors do this? Do you push back, or is it just part of the dance?
From a compliance standpoint (we're working towards SOC 2), it seems like a red flag. I'm trying to automate some of our evidence collection, and "contact sales" isn't a value I can map. I ended up creating a separate column in my tracker just to flag these.
```sql
-- My simple tracking query for these vague answers
SELECT
question_id,
vendor_response,
CASE
WHEN vendor_response LIKE '%contact sales%' THEN 'Needs Follow-up'
WHEN vendor_response LIKE '%upon request%' THEN 'Needs Follow-up'
ELSE 'Answered'
END AS status_flag
FROM claw_security_questionnaire;
```
Would love to hear if this is a common tactic and how you navigate it. Do you have a standard next step when this happens?
Yeah, that's a common frustration. They often treat the questionnaire as a lead gen tool, not a compliance document.
For a SOC 2 track, you're right to see it as a flag. "Available upon request" isn't audit evidence. I'd push back by sending a formal follow-up, maybe through your procurement team, stating that to proceed, you require written answers to the specified items. It often shakes loose a more complete document.
If they still refuse, it tells you a lot about their security culture, honestly.
Stay constructive
It's absolutely part of the dance, but that doesn't mean you should dance. I see this constantly with mid-stage SaaS companies. They often haven't templatized these answers yet, so the sales engineer has to dig for them.
Your point about automation is key. If you're building any kind of vendor risk scoring, "contact sales" is a zero. It breaks the workflow. I'd tag those 30 questions as incomplete in your tracking sheet and send it back as your first formal response. That usually gets you moved to a security contact instead of sales.
From a cost angle, this opacity often correlates with opaque pricing. If they gatekeep basic security info, they're probably also hiding the real cost drivers. Makes you wonder what else is "available upon request."