SaaSFort What enterprise procurement actually checks
Enterprise security reviews cover three areas: external posture, certifications, and data handling. External posture means what attackers see when they look at your domain: TLS version, security headers, DNS configuration, certificate validity, exposed admin panels. Certifications mean SOC 2 Type II, ISO 27001, or an equivalent audit report. Data handling means where data is stored, who can access it, and how it is encrypted at rest and in transit.
For a 30-to-200 person SaaS company, external posture is the fastest thing to fix and often the first thing reviewers check, because it is verifiable in seconds without asking you anything. Get that right first.
The document procurement actually files
Most enterprise buyers attach a vendor security assessment to your contract record. That document needs: an overall security grade or rating, a breakdown of findings by category, a mapping to the framework they use (usually SOC 2 controls, ISO 27001 Annex A, or NIS2 Article 21), and a date so the reviewer knows the evidence is current.
A scan from SaaSFort produces all four. Your A-F grade, a 60-control breakdown across 25 categories, mapping to NIS2 and ISO 27001, and a datestamp. The €39 audit pack exports it as a branded PDF you attach to the questionnaire response.
How to handle the certification question without SOC 2
If the questionnaire asks for SOC 2 or ISO 27001 and you do not have either, say so directly and offer the external scan as the available evidence: "We have not completed a SOC 2 audit. We run continuous external security monitoring mapped to SOC 2 CC6 controls and ISO 27001 Annex A. Current scan result and control map attached. We plan to pursue SOC 2 Type II in [quarter]."
Most buyers accept this from companies under 100 employees if the scan result is clean. What they do not accept is silence or a generic "we take security seriously" paragraph.
What to fix before the review starts
Run the free scan at saasfort.com/scan before the buyer does. Check these four things first: HSTS must be present with max-age of at least one year, DMARC must be in enforce or quarantine mode (p=reject or p=quarantine), your TLS certificate must be valid and from a well-known CA, and admin panel paths (anything matching /admin, /phpmyadmin, /.env) must not be accessible without authentication.
These four items appear in 80 percent of failed enterprise security reviews. Fixing them takes less than a day on most hosting platforms.
The fastest path from questionnaire to signed contract
Day 1: run the free scan, note the grade and the failing controls. Day 1-2: fix TLS, headers, and DMARC if they are failing. Day 2: re-scan, confirm the grade improved. Day 2-3: buy the €39 audit pack and attach the PDF to your questionnaire response. Then check the security-scan use-case hub for the specific scenario matching your buyer type (enterprise procurement, SOC 2 prep, or NIS2 registration).
Related use cases
The security scan by use case hub maps each common scenario to the relevant scan controls: SOC 2 prep, NIS2 registration, ISO 27001 audit, enterprise procurement, cyber insurance, and more. Pick the one that matches your situation.
Frequently asked questions
- How do I answer a security questionnaire if I have no SOC 2 or ISO 27001?
- Provide what you have: an external scan result mapped to the relevant controls, a short description of your security governance, and a timeline for formal certification if the buyer requires it. A clean scan result with a B or A grade closes most reviews at the 50-200 employee company size.
- What is the difference between an external scan and a penetration test?
- An external scan checks what is visible from the internet without authentication: TLS configuration, headers, DNS, certificates, and exposed endpoints. It runs in 60 seconds and can be repeated weekly. A penetration test involves a security engineer attempting to exploit vulnerabilities with credentialed access, takes weeks, and costs €5,000 to €20,000. Enterprise buyers ask for pen tests for high-value contracts or in regulated industries. For mid-market SaaS deals, an external scan result is usually sufficient.
- Can I get a security certificate from a scan result?
- The audit pack PDF is not a certification body certificate. It is a dated, control-mapped report you produce yourself. Some buyers file it as vendor evidence; others require a third-party certification (SOC 2, ISO 27001, Cyber Essentials). Check what your specific buyer requires before paying for a certification that may not be what they ask for.