War-game a security questionnaire before sales pressure turns soft answers into contractual representations.
Security questionnaires fail when "yes" answers outrun tested controls, when exceptions live in a private doc only, when sales edits soften precise language, and when residual risk never reaches the buyer in writing. A completed spreadsheet is not evidence.
What to freeze
State the buyer, the questionnaire version, who owns each section, the evidence pack you will attach, and the residual-risk language you will not invent away. Attach the control inventory, recent sampling notes, vendor dependencies, and the exact contract clauses the answers may bind. If security, sales, and legal disagree on what "in place" means, stop and reconcile first.
Name the decision you will make if the war game finds nothing new, and the hold criteria if any answer lacks an exhibit or named owner.
Attack surfaces
- Overclaim theater: answers that sound complete and still hide untested controls.
- Sales soft edits: wording that wins the deal and binds the company later.
- Vendor silence: third parties that concentrate risk without a named exit.
- Evidence gaps: policies that exist on paper and fail under sampling.
- Incident blindness: logging and response paths that would fail Monday.
Optional counsel seat if the answers will be exhibits to an MSA. Optional finance seat if cyber insurance or credits depend on the same claims.
How to run it
Feed Pingpong the draft answers, control inventory, and open exception list. Early passes steelman the package. Later passes attack from CISO, security lead, sales, and counsel seats. End with a pass that turns surviving objections into narrower answers, attached exhibits, or an explicit residual-risk note. Delete invented maturity and dual-counted compensating controls.
When a single yes depends on a compensating control, force the CISO and counsel seats to write the control, the sampling cadence, and the buyer-facing caveat into the answer pack. An answer that only works if nobody samples is a deferred dispute. If sales needs a faster close, trade speed for a dated exception with an owner and an expiry, then ask the skeptic seat to attack that exception until it would survive an audit follow-up.
Force a day-after narrative: what happens if the buyer samples one "yes," if an auditor asks for the same exhibit, or if an incident contradicts a claim. If those stories are stronger than your evidence pack, fix the answers before they leave the room. When sales wants a faster close, ask the CISO seat to write the minimum language that still tells the truth. Related: pretend you are the CISO, pretend you are the security lead, stress-test a security incident response, war-game a pilot contract, and the war-game decisions hub. Process: how to run a Pingpong.