The Security Questionnaire Has 340 Questions. Here's How We Handle It.

The email lands on a Tuesday. Subject line: "Security Review, Response Due in 10 Business Days." Attached is a spreadsheet. 340 rows, conditional formatting, a tab for network security, a tab for data handling, a tab for subprocessors, a tab for HR and offboarding. The deal is six figures. It's in late-stage procurement. And now it's stuck behind a document that reads like it was written to be exhaustive rather than answerable.

Nobody on your team has 340 answers sitting ready. So it gets routed to whoever's available, usually an engineer pulled off product work, who now has to explain your background check process and your subprocessor list between sprint tasks. The deal clock keeps running. This is not because your security posture is weak. It's because there's no process for turning what you actually do into an answer somebody can send back with confidence.

Here's what we actually do when this lands on our desk.

Day one: triage, not answer

We don't start at row one. We sort the 340 rows into three piles. Questions we already have a written answer for, from a previous questionnaire or your trust center. Questions that are new but answerable from your actual environment in ten minutes. Questions that need someone with real authority, security lead or engineering, to weigh in before we commit to an answer.

Most 340-question spreadsheets have somewhere between 200 and 260 questions that are functionally duplicates of things you've answered before, just reworded. If you've built a response library, that's most of the document handled by lunch.

Days two through four: the response library does the heavy lifting

If you've never done this before, this is where we build it. We pull your last five to ten questionnaires and extract the questions that repeat: encryption at rest, incident response process, subprocessor list, background checks, data retention. We write one clean, accurate, current answer for each. Every future questionnaire becomes a matching exercise instead of a blank page.

For a first-time 340-question document with no library, this step is most of the work. For a company we've already built a library for, it's an afternoon.

The 15 to 20 questions that actually need a human

Every big questionnaire has a handful of questions that aren't looking for a standard answer. They're testing whether you understand your own environment, or trying to surface a specific gap. "Describe your process for detecting unauthorized access to production data." "What compensating controls exist if your primary DLP tool fails." These get routed to whoever actually owns that part of the environment, and we push back on generic non-answers. A vague paragraph here is worse than a precise "we don't do X, and here's why that's not a gap for your use case."

Where we push back on the buyer, too

Not every question deserves a full paragraph. Some rows are boilerplate copied from a template that doesn't apply to a SaaS company your size. We answer those directly and briefly: "Not applicable. We don't process card data" beats three sentences pretending the question was relevant. Overexplaining a non-issue reads as uncertainty to a sophisticated reviewer, not diligence.

When we skip the spreadsheet entirely

For a meaningful share of deals, we resolve the whole thing with a fifteen-minute call between your security lead and theirs, plus your SOC 2 report and a trust center page. Sophisticated buyers often prefer this. It's faster for them, and a confident live conversation is a better signal of a mature security function than a perfectly worded 340-row document ever is.

What this actually costs you if you don't have a process

A questionnaire like this, handled ad hoc, eats two to three weeks of an engineer's time spread across a month, plus the actual deal delay while procurement waits. Handled with a library and clear ownership, the same document is a day of real work and a few days of routing and follow-up. Same questions. Same buyer. Very different cost.

If a 340-row spreadsheet just landed on your desk and you don't have a library yet, don't start answering row one. Start sorting. The sort is the whole difference between a two-week fire drill and a two-day turnaround.