Handling a customer's security review during a deal

How the SaaS pack places a prospect's security review in the sales workflow, from the document request to the signed order form that closes the deal.

By Achekam · 11 October 2026 · 4 min read · For Software (SaaS) businesses in South Africa, Nigeria, Kenya

Launching soon. The Industry CRM add-on described in this article is launching soon. This article describes it as it will work at launch.

The demo went well, the champion is keen and the budget is approved. Then an e-mail arrives from the prospect's IT risk team: before procurement can proceed, please complete the attached security questionnaire, provide your information security policy, describe your backup and incident response arrangements, and name the person responsible for personal information.

For a small software company, that e-mail can stall a deal for weeks. The questionnaire lands in one person's inbox, gets forwarded to an engineer who is busy shipping, and the account executive has no idea where it stands. Achekam's Industry CRM gives the SaaS pack a defined place for the security review in the sales workflow, so it becomes a tracked step rather than a lost e-mail.

Where the security review sits in the sales workflow

In the SaaS & B2B tech pack, customers are Accounts, deals are Opportunities and quotes are Order forms. A product-qualified lead is routed to an account executive by your own rule, and the opportunity then runs through discovery, a demo, an optional security-review request, the order form and its electronic signature.

The word "optional" matters. Not every buyer asks for a review. A small agency buying a handful of seats will not; a bank, an insurer or a listed retailer almost always will. Use the step where the buyer requires it and skip it where they do not, so the workflow reflects the deal in front of you rather than a checklist nobody needs.

The opportunity itself moves through the pack's stages from Trial to Product-qualified, Demo held, Proposal sent, Negotiation and Won. In practice the security review usually runs alongside Proposal sent and Negotiation, because procurement will not sign until it is cleared.

Sending the request and receiving the documents

A workflow step in the Industry CRM can send the customer a request for documents. For a security review, use it to ask the prospect for everything their side needs to send you: their questionnaire, any supplier security standard they expect you to accept, and the name of the person on their side who will review your answers.

When the customer answers, their answer moves the task on. The account executive can see that the review has started without chasing anyone, and so can the person in your team who completes the answers.

Asking up front for the reviewer's name and deadline saves a round of e-mail later. So does asking whether they accept a standard pack of your policies in place of answering every question in their own format.

The customer's answer moves the task on

Once the questionnaire is in, the work is yours. Tasks in the Industry CRM can have subtasks up to three levels deep, and a workflow creates its tasks stage by stage. Split the review the way the questionnaire is split:

Agree in the team who handles each section, and keep the subtasks open until the answers are checked by someone other than the person who wrote them. A wrong answer in a security questionnaire can become a contractual promise.

Questionnaires often ask who is responsible for personal information in your company. For South African companies, the Information Regulator's guidance note on Information Officers explains who the Information Officer of a business is, how deputies are designated and registered, and what they are responsible for. Nigerian and Kenyan companies should answer under their own data protection law and regulator.

Won only once the signature task is done

An opportunity in the SaaS pack cannot be marked Won until a signature task on it is done. More generally, a record cannot move into some pipeline stages until set conditions are met, such as a customer being named, an amount being set or a signature being done.

That rule protects you from a familiar mistake: the security review clears, everyone relaxes, the deal is called won on a phone call, and the order form is never signed. With the pack, the review clearing is a milestone on the way, not the finish line. The order form still has to be sent and signed electronically before the opportunity reaches Won. For the internal approval that should come before the customer sees the order form, see order forms: internal approval, then the customer signs.

Keeping the answers on file

The answers you give in one review are the starting point for the next. Keep the completed questionnaire, the policies you sent and any follow-up correspondence in Document Centre, in a folder per account, tagged with the opportunity's name. Document Centre keeps earlier versions when you upload a new one, so you can see exactly what you told each customer and when.

When the next prospect asks for your security policy, share it from Document Centre by a personal link with an expiry and download switched off, rather than attaching it to an e-mail that can be forwarded anywhere. You can revoke the share if the deal falls through.

Who in the team owns the review

Name one owner for security reviews across all deals, usually the most senior engineer or a founder, and make them responsible for the standard answer pack. Account executives own the deal; the review owner owns the accuracy of what the company promises. Settle that split before the next large prospect sends a questionnaire, and read from product trial to won deal for the rest of the sales path the review sits in.

General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.