Your CFO should read the security questionnaire before your engineers do

Infinia · 2026-10-15

Your CFO should read the security questionnaire before your engineers do

A fractional CTO said something to me this week that I can't stop thinking about:

"The moment I'm built for is the first enterprise security questionnaire or SOC 2 ask, which tends to land right around a raise. Your CFOs probably see that moment coming before anyone else does."

Most founders will read that and disagree. Security is an engineering problem. The CFO does spreadsheets. Why would finance see it first?

Because by the time your engineers see the questionnaire, the deal is already at risk. And in my view, the person who should spot that risk first is the one who owns the pipeline and the raise, not the one who owns the code.

That's the argument of this post. Plenty of people will tell me it's backwards. Let me make the case.

The scene every founder at $2M ARR knows

The champion loves you. The budget is approved. Procurement says "just a formality." Then IT sends a spreadsheet with a couple of hundred questions.

Here's what usually happens next:

1. The founder forwards it to the best engineer.
2. The best engineer stops shipping for a week.
3. Half the answers say "planned" or "in progress."
4. IT replies with follow-up questions.
5. The quarter ends. The deal slips to "next year."

Nobody in that story did anything wrong. The engineer answered honestly. The founder delegated sensibly. But nobody owned the outcome, and the outcome wasn't a security outcome. It was a revenue outcome.

The controversial part: this is a finance problem first

Here's what a good fractional CFO sees that nobody else in the company is watching:

• Which deals in the pipeline are enterprise deals. Those are the ones that will send a questionnaire.
• When they're expected to close. That's when the questionnaire will land, usually four to eight weeks before.
• Which of those logos are going in the Series A deck. If the round story depends on "we're moving upmarket," the questionnaire is now a fundraising risk.
• What it costs to be ready versus what it costs to slip. A delayed $120K contract is more than revenue. It's a hole in the forecast you're about to show investors.

Your engineers can't see any of that from inside the codebase. Your CFO can see all of it from the forecast.

So my position is this: if your CFO isn't flagging the first security questionnaire a quarter before it arrives, nobody is.

Why founders hate this argument

I've heard the objections, and some of them are fair.

"Security is technical. Finance people shouldn't touch it." Agreed. The CFO shouldn't answer a single question on the questionnaire. Their job is to say "this is coming, and here's what it's worth," so that someone technical owns it in time.

"We'll just get SOC 2 when a customer asks." That's the most expensive time to start. A SOC 2 audit takes months, not weeks, and the customer who asked won't wait. You'll be paying for the audit while the deal sits in limbo.

"We're too small for this." Maybe. See the section below on when this doesn't apply.

"Of course an introductions company says you need two people." Fair. Judge the argument on its own, and ignore it if it doesn't fit you.

What it looks like when the CFO and CTO work together

When a part-time CFO and a part-time CTO are both in the picture, the first security questionnaire goes differently:

Neither role does the other's job. The CFO owns the number: which revenue depends on passing security review, and when. The CTO owns the answer: what's true about your security today, and what will be by the time it matters.

That's what "own a number, not a calendar" means in practice. Nobody is billing you for hours of SOC 2 meetings. Each owns a result.

Five questions to answer before the first questionnaire lands

If you can answer these in one sentence each, you're ahead of most founders at your stage.

1. Where does customer data live, and who can touch it? If the answer is "AWS, and most of the engineers," that's what they'll write down.

2. What happens when an engineer leaves? Which keys get rotated, which access gets cut, and who checks.

3. How would you know if you'd been breached? Not "we'd notice." Which alerts, who gets them, and what happens next.

4. When did you last restore from a backup? Having backups isn't the question. Proving they work is.

5. Which of your AI tools see customer data? This question is showing up more and more, and founders are often least ready for it.

And one question for finance:

6. Which deals in the next two quarters will require passing security review, and what are they worth?

If you can't answer the sixth, you don't know what the first five are worth.

When this doesn't apply

I'd be lying if I said every founder needs this. You probably don't if:

• You don't sell to enterprises. SMB and self-serve customers rarely send questionnaires. Keep shipping.
• You're under $1M ARR. You need product-market fit more than a security story.
• You already have someone who owns it. If a senior engineer is already keeping your security documentation current and the founder knows the pipeline cold, you're covered. Don't add people to solve a solved problem.
• No raise and no enterprise deals in the next two quarters. Come back when one of those changes.

If any of those is you, we'll tell you so. That's part of how we work.

The bottom line

Your first security questionnaire is not a compliance exercise. It's the moment your sales pipeline, your engineering team and your fundraise all depend on the same spreadsheet, and usually nobody owns it.

The CTO should own the answers. The CFO should see it coming. Most founders at $1M to $5M ARR have neither, so the founder ends up doing both at midnight.

If you have a raise coming and an enterprise deal in the pipeline, start here: infinia.fun/for-businesses/intake