Indeed. I get these security "wall of questions" for my $10/lifetime SaaS product (it's a dumb little puzzle maker). I can't fathom why anyone thinks a vendor would spend the time answering their questions for that kind of money.
In their defense, it's probably a standard part of the procurement process and they don't even look at the app before sending the questionnaire.
The audit focuses far more on technical aspects of business continuity than actual security. There's certainly plenty of overlap, but other than the parts about access controls and "who watches the watchmen" aspect, ISO27k is almost entirely about your ability to recover from even the most devastating disaster. The pragmatic security parts have a bolted-on feeling to ensure the recovery path remains largely uncorrupted.
https://www.iso.org/isoiec-27001-information-security.html
(Even so, your point is well taken. The overall 27000 series is more business continuity (DR etc) focused rather than purely security focused.)
Source: I worked on compliance management software for a while and VSAs were a major pain point for our customers (small to mid market companies trying to sell to enterprises).
IMO, ask for the company's SOC-2 once you've demonstrated that you are a legitimate prospective customer with a budget and not a competitor or social engineer.
That should address most concerns, or at least make the questions more salient, and it has the added benefit of being vetted by a third party.
If they don't have one, then proceed with the dumb questions, but as you quite correctly point out, no one should be surprised if some questions are rebuffed.
However, SOC2 takes it a step further and requires an formalized audit from a AICPA certified security auditing firm[0].
Therefore, a security questionnaire should be for follow-up items that the customer feels were not adequately addressed in one or more of the vendor's compliance attestations.
Otherwise, the customer is asking the vendor to step through redundant check-the-box busywork that actually requires a higher level of skill that can not be adequately completed by a junior engineer. To wax hyperbolic, it's like an engineering DoS attack which serves neither the customer nor the vendor well (unless the goal is to slow down the vendor from making new and better products)
0. https://www.aicpa.org/interestareas/frc/assuranceadvisoryser...
For example, as far as I can tell, "HIPAA" is spelled "HIPPA" on your website – this indicates a lack of familiarity with the Act (and potentially professionalism) to me as a first-time user, regardless of the multiple kinds of certifications you might have.
Is it possible you could have caught that when replying to a simple set questionnaire like the one in the link but focused on HIPAA?
We do respond to every single email, and hopefully fairly intelligently most of the time ;), even if the customer is a hobbyist or free tier user, especially with regards to security questions. (Although internal stats are slightly meaningless, and survey responses are relatively uncommon for the volume of emails we receive, we do have >99% customer support satisfaction based on our internal tracking.)
> Is it possible you could have caught that when replying to a simple set questionnaire like the one in the link but focused on HIPAA?
Ha, looks like we mispelled it in one place and spelled it correctly in another! Are you asking if we'd have caught a misspelling or other oversight on our website on the basis of an emailed questionnaire? Good question, but, to be honest, doubtful (but thank you for bringing it to my attention -- fixed!)
We've had wall-of-questions requests like that before, and we either respond with our other certs/attestations, or negotiate a BAA, once we get down to more specific questions. For HIPAA, we're providing on-premise security software, and not working with PHI in any way (we're deployed in some hospital systems in the US), so generally customers are just looking to understand our general security stance and how we can help them meet the Security Rule with login accounts.
There's a reason why standardized third-party audits like SOC-2's and ISO-27001's exist: to reduce the time required to document your veracity and security as a vendor for a potential customer. Since even large customers rely on the statements (independently audited, unlike in these questions) of a security attestation to make purchases, why should a customer request that extra time should be taken away from other responsibilities, like making better products or providing customer support?
I freely admit that I'm a bit biased against ad hoc security questions, even though I used to do it myself when working on large security teams. ;) My security-focused SSH key management company, https://userify.com, went through the time and expense to achieve AICPA SOC-2 certification from an independent third-party auditor to reduce the time and costs involved in responding to smaller RFP's, and to provide fully documented, standardized, and legally binding proof of our security bonafides. We still try our best to intelligently respond to any and all questions, especially about security, from any customers at all, even free-tier customers and hobbyists, but it's harder to do that when presented with a big list of questions that are mostly answered in our SOC-2 audit already.