You have won the client. Then their security team sends a questionnaire, or procurement asks for your most recent penetration test report, or someone says the word SOC 2. The contract is waiting on it and nobody in the company has done this before. This happens to Pakistani software houses constantly, and the first thing worth knowing is that these are four different requests with very different costs and timelines.
First, work out which request you actually received
People use these terms loosely, including the people asking. Before you quote anything to your client or buy anything from anyone, read the request again and decide which of these it is.
A security questionnaire
A spreadsheet or portal with anywhere from thirty to three hundred questions about your policies, access control, encryption, backups and staff training. You fill it in yourself.
Cost: your own time. Timeline: a few days to a couple of weeks. This is the most common request and the cheapest to satisfy, though an honest one will expose gaps you then have to decide what to do about.
A penetration test report
They want evidence that an independent party has tested your application and that you fixed what was found. This is the most common hard requirement for software companies.
Cost: from a few hundred US dollars for a single small application upward. Timeline: typically two to four weeks including remediation and a retest. This is achievable inside most procurement deadlines if you start immediately.
SOC 2
An attestation report produced by a licensed CPA firm about your controls over a period of time. A Type I looks at control design at a point in time. A Type II looks at operating effectiveness over a window, commonly three to twelve months.
Cost: substantially more than a penetration test, and it recurs annually. Timeline: months, not weeks, and a Type II cannot be compressed because the observation window is the whole point.
If a client asks for SOC 2 with a three-week deadline, the deadline is wrong rather than the ask. Say so early.
ISO 27001
Certification of an information security management system by an accredited certification body. More common from European and Gulf clients than American ones.
Cost and timeline comparable to SOC 2 or longer, typically three to nine months of readiness work before the audit.
What to say to the client this week
The worst response is silence while you work out what to do. Procurement reads that as a company that does not have its act together, which is precisely the impression the request exists to test.
Reply quickly with three things.
Acknowledge the request and name what you are going to provide. Give a date. Ask whether an alternative satisfies them.
That third point is where most of the value is. Clients frequently accept a recent independent penetration test report plus a completed questionnaire in place of a full certification, particularly if you are a smaller supplier and the data involved is not highly sensitive. Nobody will offer you that substitution. You have to ask.
A useful sentence: "We can provide an independent penetration test report with remediation evidence by the 30th. We are not SOC 2 certified today. Would that satisfy your requirement for this engagement?"
If they want a penetration test report, here is what happens
This is the path most of you will take, so here is the realistic sequence.
Scoping, one to three days. You provide the application URLs, say whether we test production or a staging copy that genuinely mirrors it, and give one test account for each user role. The roles matter. Testing with a single account cannot prove that one customer is unable to read another customer's data, which is exactly what your client's security team cares about.
Testing, five to ten working days for a single application. Longer if there are multiple applications, many roles, or a large authenticated surface.
Report, two to three days after testing ends. Executive summary, then each finding with impact, severity, reproduction steps, evidence and a specific fix.
Your fixes. This is the step companies forget to budget time for, and it is usually where the deadline is actually lost. Leave a week.
Retest and attestation letter. We re-verify the fixed findings and issue a letter stating what was tested, when, by what methodology, and that the identified issues were remediated and verified. That letter, not the raw report, is usually what you send to the client.
Start to finish, three to four weeks is realistic. Two is possible if your developers are responsive.
Should you send the client the full report?
Usually not, and you are not being evasive by saying so.
A full penetration test report contains reproduction steps for vulnerabilities in your system. Even after remediation, that is a sensitive document, and your client's procurement inbox is not a secure destination.
Standard practice is to send the attestation letter, which confirms the test happened, its scope and dates, and that findings were remediated and verified. If the client's security team wants more, offer a redacted report, or a call where you walk them through the findings summary.
Most clients accept the letter. The ones that do not are usually enterprises with their own vendor security process, and they will tell you exactly what format they need.
The questions on these questionnaires that catch Pakistani companies out
Having filled in a lot of these with clients, the same handful cause trouble, and none of them are hard to fix in advance.
"Where is customer data stored?" If the honest answer is a shared hosting account, or a personal cloud account in a founder's name, fix that before answering. This single question has lost more contracts than any vulnerability.
"Do you have documented security policies?" A short, true policy set beats a long template you downloaded. Auditors and security teams can tell the difference immediately, and a policy that describes a company you are not is worse than admitting you are early.
"How do you manage access when staff leave?" They are asking whether a developer who left last year still has repository and production access. Check before you answer, because frequently they do.
"Do you run background checks?" Often a straight no for Pakistani SMEs and often acceptable, particularly if you can describe what you do instead: reference checks, signed confidentiality agreements, least-privilege access.
"Do you have cyber insurance?" Increasingly common. Being uninsured is not automatically disqualifying, but know the answer before the call.
"Is MFA enforced for all staff?" If not, this is the highest-value thing you can fix this week. It is cheap, fast, and it appears on nearly every questionnaire.
Answer honestly. Security teams are used to suppliers who are not perfect. They are much less tolerant of suppliers who claimed something that turns out not to be true, because that changes the question from capability to trust.
What to do if the deadline is already too close
Three weeks and they want SOC 2. It happens. In rough order of usefulness:
Ask what the requirement is protecting against. Sometimes it is a policy applied uniformly, and a smaller supplier handling non-sensitive data can be granted an exception or a timeline.
Offer a credible plan instead of a certificate. An independent penetration test completed now, plus a written commitment with dates to a SOC 2 Type I, satisfies many clients. It shows direction, which is what they are actually buying.
Do the penetration test regardless. It is the fastest credible piece of independent evidence available to you, and you will need it for the next client too.
Do not buy a certificate from anyone who promises one quickly. SOC 2 attestations come from licensed CPA firms and ISO 27001 certificates from accredited bodies. Anyone selling either in two weeks is selling something that will not survive the client's own check, and failing that check is worse than being honest about where you are.
Doing this once so it stops being a fire drill
The companies that handle this well are not the most secure ones. They are the ones that prepared the artefacts once.
Keep a security pack ready: a current penetration test attestation letter, a short policy set that matches reality, an architecture and data flow description, your access control and offboarding process, and a completed master questionnaire you can adapt.
Run the penetration test annually and after major releases, so the letter is never more than a year old. A report dated eighteen months ago invites the question of what has changed since, and you will not have a good answer.
Appoint one person who owns this. Not necessarily a security specialist, but somebody whose job it is to respond rather than whoever happens to be free.
The first time costs you a few weeks of scrambling. After that it is a folder you send.
Where we fit
We are a Pakistani security firm based in Multan, and this is one of the most common reasons companies here call us. Manual penetration testing by OSCP-certified engineers, a report written so a client's security team can read it directly, a retest, and an attestation letter you can actually send. A single web application starts at USD 399 and a full manual penetration test is USD 1,500.
We will also tell you when you do not need us. If your client would accept a completed questionnaire and you can answer it honestly, say so and keep your money. We would rather be the firm you call next year than the one that sold you something you did not need this year.
If you have a client request in front of you right now, send us what they asked for and we will tell you what it actually requires and whether the deadline is achievable.
0 comments
Leave a comment