Security documents your first enterprise customer will ask for
Startups rarely need a binder of policies on day one. You need the right few documents when a customer, investor or insurer asks. Here's what to have, and when.
The moments that trigger the question
First enterprise customer
Your first enterprise customer sends a security questionnaire.
SOC 2 or ISO/IEC 27001
A customer asks for SOC 2 or ISO/IEC 27001.
Investor due diligence
An investor reviews your security posture before a round.
Cyber insurance
An insurer asks how you manage risk before quoting.
App stores and privacy laws
Apple App Store privacy details, Google Play Data safety, and privacy laws such as GDPR and PIPEDA.
Your product uses AI
Customers ask how you govern AI and AI agents; the EU AI Act may apply.
What to have, stage by stage
| Stage | When | Documents |
|---|---|---|
| Stage 1 | Before your first enterprise deal | Information Security Policy (IT-04) · Access Management Standard (STD-01) · Incident Response Plan (IT-06) · Risk Register & Asset Inventory Workbook (IT-WB) |
| Stage 2 | When you sell to larger customers or raise a round | IT Security Program Kit (adds governance, risk method, business continuity and the control register) · AI Acceptable Use Policy (AI-02) if staff use AI tools · Secure Development and Mobile Application Security Standard (STD-06): how you build, test and release web, API, mobile and AI software, with SBOMs and vulnerability disclosure. Enterprise customers and investors' technical due diligence ask for this. |
| Stage 3 | If your product is AI | AI Agent Security Standard (STD-04) for agents that act on systems · AI Governance Kit for risk assessments, vendor checks and AI incidents · Post-Quantum Cryptography Standard (STD-05) if you hold data that must stay confidential for years |
These templates help you prepare for SOC 2, ISO/IEC 27001 and customer reviews. They don't certify compliance; an independent auditor does that.
What enterprise reviewers ask, and where you'll find it
| They ask about | Where it's covered |
|---|---|
| Security policy | IT-04 Information Security Policy |
| Access and MFA | STD-01 Access Management Standard |
| Secure development, SBOM, pen testing, fix times | STD-06 sections 4–9 |
| Vendor and SaaS risk | Quick-Start Guide section 5, tracker SaaS Vendors sheet, IT workbook Suppliers sheet |
| Security awareness training | Quick-Start Guide section 4, tracker Training Log |
| Incident response | IT-06 Incident Response Plan |
| Backups and disaster recovery | IT-07 BCDR Plan and BIA workbook |
| AI and AI agents | STD-04 AI Agent Security Standard |
| Privacy | Partly: security and breach response; guide section 7 lists what a privacy program still needs |
| Mobile app data and app-to-API security | STD-06 section 10, Quick-Start Guide section 6 (mobile checklist and MASVS profiles) |
| Evidence auditors sample | Quick-Start Guide section 8, tracker Evidence Log |
Common questions from founders
Do we need SOC 2 before selling to enterprises?
Not always. Many customers accept a security questionnaire plus your core policies at first. SOC 2 usually comes when deals get larger.
We're 5 people. Isn't this overkill?
Start with Stage 1: four documents you can adapt in a few days.
Do the templates cover mobile app security?
Yes. STD-06 section 10 sets mobile app requirements following the OWASP Mobile Application Security Verification Standard (MASVS), plus app store privacy disclosures and signing key protection. Use the free OWASP mobile testing guide to test against it.
Can we use them for our clients?
The licence covers use within your own organization only. Contact us about consultant use.
Reading list
- Artificial intelligence for small business: managing cyber security risks — joint guidance from ASD's ACSC, NCSC-NZ and COSBOA (January 2026). Our AI documents are reviewed against it and draw on it.
Coming soon for startups
Customer Security Questionnaire Kit and Vendor Security Kit — join the waitlist on either page and we'll tell you when they launch.
Start with the four documents in Stage 1
Adapt them in a few days, and you're ready for the first questionnaire.