Triage each questionnaire into one of three paths: answer in full, answer by pointing to standard evidence, or push back and propose a shorter route. The deciding factors are deal size, stage, questionnaire quality and what you have already published.
Why triage matters
A team that answers every questionnaire from scratch treats a free trial and a large contract the same. That burns the people who also run your security program. Triage is a rule you agree on once so nobody argues it each time.
The three paths
Path one: answer in full. The buyer is late stage, the deal is meaningful, and the questionnaire is a recognised standard or is well written. Pull from your answer library, have owners review, and send within the agreed time.
Path two: answer by evidence. The questions mostly repeat what is in your published documents. Send your standard questionnaire response, your trust page link and your audit report under NDA if you have one. Offer to answer any specific gaps. Many reviewers accept this.
Path three: push back. The questionnaire is early in the cycle, has hundreds of questions, or asks for things no vendor would share. Reply with what you can send now and offer a short call to cover the rest once the deal advances.
A scoring sheet
Give each incoming questionnaire a score from one to three on:
- Stage. Early evaluation is one, procurement sign off is three.
- Size of opportunity. Use your own bands.
- Question quality. Duplicate and irrelevant questions lower the score.
- Coverage by existing documents. High coverage favours the evidence path.
Add the scores. Low totals go to path three, middle to path two, high to path one. The numbers matter less than having a rule.
How to push back politely
Keep it factual. "We can send our standard security overview and questionnaire response today. If anything is missing for your review, tell us which items and we will answer those directly." Most reviewers prefer a quick partial answer to a long delay.
Track the pattern
Log which buyers needed which path. If one question keeps appearing on path one, publish the answer. See the post on what to publish on a trust page.
Watch for the hidden commitments
Some questionnaires bury contractual asks, such as audit rights, specific response times or data residency. Route those to legal. A casual "Yes" in a spreadsheet can become a contract term.
Quick check
Can we refuse to fill in a customer's custom spreadsheet?
You can propose an alternative, such as a standard response, but be ready for some buyers to insist. Decide in advance who may approve exceptions.
What is a reasonable turnaround target?
Pick one you can meet, such as five working days for path two and ten for path one, and tell the buyer up front.
Last reviewed: 19 October 2026.
