The deal goes well right up to the day the customer’s buyer sends over a spreadsheet with 120 rows. Then everything stops. For many Swedish SaaS companies the security questionnaire is the point where an enterprise deal loses momentum, and it is rarely what it looks like. A vendor assessment is less about having the right answer to every question and more about showing that somebody on your side owns the subject.
What makes 2026 different is that the customer is no longer asking out of politeness. Several pieces of regulation have made reviewing you a legal duty for them. Here is what they are actually looking for, the formats you will meet, and what separates an answer that closes the deal from one that drags it out for months.
Why the review got harder
Three things have happened over the past two years, and all three point downward through the supply chain.
NIS2 and the Swedish Cybersecurity Act. The Cybersecurity Act (2025:1506) came into force on 15 January 2026. The NIS2 directive behind it expressly requires covered organisations to manage supply chain security and to assess the vulnerabilities and security practices of their direct suppliers, including their secure development routines. So your customer is not doing this out of suspicion. They are doing it because they must.
DORA. If you sell to a bank, an insurer, a payment provider or another financial entity, the EU regulation on digital operational resilience has applied since 17 January 2025. It sets detailed requirements for what has to be in the contract with you. More on that below.
The EU Data Act. Since 12 September 2025 customers have had the right to switch cloud provider without undue obstacles. Export formats, migration support and notice periods have moved from negotiating points to legal requirements, and they now show up in questionnaires under portability or exit.
What this means for you in practice: these rules usually reach you through the customer’s contract and questionnaire rather than directly. With one important caveat. Cloud service providers are among the sectors NIS2 itself names, so once you pass 50 employees or 10 million euro in turnover the Cybersecurity Act may apply to you directly and not only through the customer. Check that before you answer “we are not covered” in a questionnaire. It is the same pattern we described in supplier security requirements, with a sharper edge for anyone selling software.
What the four common pieces of evidence are worth
A vendor assessment usually comes down to four things. The order below reflects how heavily they weigh in an enterprise review.
SOC 2 Type II. The American audit report still carries the most weight with international buyers. Worth knowing: a Type I describes how things looked on a single day, a Type II covers a period, usually six to twelve months with twelve as the norm. Three-month periods occur, most often as a company’s very first report. Buyers with capable reviewers do not just note that the report exists. They read its scope, the period it covers, the exceptions the auditor noted and how your subcontractors were handled. A narrow report with many exceptions can be worse than none, because it shows exactly where you fall short.
ISO/IEC 27001. The international standard, and the one Swedish and German buyers ask for most often. One thing to check today: certificates under the old 2013 version ceased to be valid on 31 October 2025. Producing one is not weak evidence, it is invalid evidence. The same applies in the other direction, when you review your own subcontractors.
A penetration test. A current test by an independent party, with a summary you can share and a remediation list showing what you did with the findings. The remediation list often matters more than the test. It shows you have a process rather than a piece of paper.
The data processing agreement and the sub-processor list. A current agreement and a complete, up-to-date list of which subcontractors process the customer’s data, where they are and what they do. That list is the single most common reason answers drag on, because almost no growing SaaS company has it complete.
Do you need a certification to sell? Usually not, at least not at first. Many buyers accept documented, systematic working practice, exactly as in public procurement. But the larger the customer, the more often certification becomes a mandatory requirement rather than an advantage.
The questionnaires you will meet
Three formats cover most of it.
CAIQ, from the Cloud Security Alliance, is the most common cloud-specific form. Version 4.1 was released in January 2026 and becomes mandatory for STAR registration at the end of 2027. A completed CAIQ that you publish or share proactively can answer large parts of a questionnaire before it is even sent.
SIG, from Shared Assessments, is broader and used in more structured vendor programmes, often in finance and insurance. There is a shorter variant for less critical suppliers.
The customer’s own spreadsheet. Still the most common in Sweden. It is unstructured, partly irrelevant to your service, and nearly always contains questions assuming you run your own server halls. It takes the most work and gives the least reuse, unless you build an answer library of your own.
An AI strand has appeared as well. The Cloud Security Alliance has launched AI-specific controls and an AI-CAIQ, and ISO/IEC 42001 for AI management systems is starting to show up as a wish among larger buyers. If your service has AI features, expect questions about training data, human review and AI literacy among your people within the next year.
Selling to financial services? DORA writes the contract
This is the section that surprises most people. When a bank, an insurer or a payment provider buys your service, they are obliged to get a set of terms into the contract. That is not negotiable for them, which in practice means it is not negotiable for you either.
Each contract has to include, among other things, a full description of the service, rules on subcontractors, the countries where the service is delivered and data processed, service levels, your duty to assist during IT incidents, your duty to cooperate with supervisory authorities, termination terms, and the customer’s right to get their data back in an accessible format.
If your service supports a function the customer counts as critical or important, more follows: quantitative service level targets, reporting where there is material impact, requirements on continuity plans, participation in threat-led penetration testing where relevant, ongoing audit and inspection rights, and an exit strategy with an agreed transition period.
One practical detail is often the first point of friction: financial entities have to report a register of information on their IT providers to the Swedish Financial Supervisory Authority every year, by 28 February. To fill it in they need structured details from you, exact delivery countries and the whole subcontractor chain among them. Deliver that in a day rather than three weeks and you become an easy supplier to have.
Do you need to worry about being designated a critical ICT third-party provider under EU oversight? No. Those criteria target systemically important players that are hard to replace at a European level. A Swedish SaaS company of ordinary size does not end up there. The contract requirements apply all the same.
What kills the deal
Answering yes without being able to prove it. The most expensive mistake, and the one that does the most damage to trust when it surfaces. An honest “no, but this is how we manage the risk” almost always weighs more than an unevidenced yes.
Having no owner. When the questionnaire arrives and three people separately hunt for the same document, it takes weeks. With a named owner and one library it takes hours. The customer sees the difference immediately and reads it as maturity, or the lack of it.
No incident routine with times in it. Almost every questionnaire asks how quickly you notify the customer of an incident. Without a documented incident process with deadlines the answer is vague, and vague answers generate follow-up questions that cost further weeks.
Treating every questionnaire as new. Without an answer library you do the same work every time. With one, the time per deal keeps falling.
Building readiness
- Appoint an owner. One person who holds documents, answers and versions together. Not a committee.
- Gather the basic documents. Information security policy, incident routine, data processing agreement, sub-processor list, continuity plan, the latest penetration test report. Our list of the most important compliance documents is the starting point, and the information security policy is where most questionnaires begin.
- Fill in a CAIQ in advance. Even if nobody has asked. It forces the answers out while you have time, and gives you a finished base to copy from.
- Build the answer library. Every answered question is saved with its evidence. The next questionnaire becomes copying plus adapting.
- Clean up the sub-processor list. Work through which services actually touch customer data. This takes the longest and pays back the most.
- Set a date for the certification decision. Decide at what deal size or customer segment you go for ISO 27001 or SOC 2. Putting the decision off until a customer demands it means losing that particular deal.
A reasonable target: from questionnaire in the inbox to questionnaire answered in under a week, with nobody working a weekend.
Common questions
Do we need SOC 2 or ISO 27001 to sell to large customers? Not always, but increasingly. With Swedish mid-sized customers, documented security work is often enough. With international groups and the financial sector, a certification or audit report is in practice an entry requirement. Make the decision before a customer forces it.
What is the difference between SOC 2 Type I and Type II? Type I describes the controls at a point in time. Type II shows that they worked over a period, usually six to twelve months. Buyers who know the field ask for Type II.
Can we point to our cloud provider’s certifications? Partly. Running on a certified platform covers the infrastructure, not how you develop, control access and handle customer data. The customer is reviewing you, not your supplier. Expect follow-up questions if you try to lean on the platform all the way.
How do we handle questions that clearly do not apply to us? Answer “not applicable” and write one sentence on why. Never leave a row blank. A blank row reads as a missing answer, not as an irrelevant question.
What do we do if we do not meet a requirement? Be open about it, describe how you manage the risk in the meantime, and say when you plan to be in place. Many buyers accept a credible plan. Almost none accept being misled.
We are five people. Is all this really reasonable for us? The scope should be proportionate to your size and to the data you handle. A small company with clear documents and precise answers comes through a review better than a large one sending generic attachments. The demand for structure does grow with the customer’s size, whatever yours is.
Where Polaris comes in
Polaris keeps policies, routines, agreements and evidence in one place, with version history and an owner per document. When the next questionnaire arrives the work starts in a finished library rather than in a folder nobody can find. You also see the gaps before a customer’s reviewer finds them for you.
This article is general guidance, not legal advice. Requirements differ between customers and industries, and the rules keep developing. Always read the current contract and the current requirement text, and get help where you are unsure.
