You just got a security questionnaire. Here's exactly what happens next.

It arrived from procurement with a deadline and a cheerful note: "just a standard security review." It is a spreadsheet with hundreds of rows, the deal is paused until it's returned, and the person expected to fill it out — probably you — didn't build half the controls it asks about. This guide is the playbook for getting it off your desk without stalling the deal or signing up for fiction.

First: understand what the document does

A security questionnaire is a gate in your customer's purchase process. Until it's returned, nothing moves — no redlines, no signature, no invoice. And once returned, your answers usually live in the vendor file and inform the contract's security representations. Both halves matter: speed unblocks the deal; honesty keeps the deal from becoming a liability.

Step 1 — Triage before you answer anything

Read every question once, answering nothing. Tag each row one of three ways:

• Know it — you can answer and name the evidence now.
• Need to ask — someone in engineering, IT, or legal has this.
• Genuine gap — the control doesn't exist today.

The tag counts tell you the real project: how many hours, which colleagues, and whether the deadline is achievable. They also tell you whether to negotiate scope — it is completely normal to reply with clarifying questions before committing to a date.

Step 2 — Answer to what you do, not what you intend

The single most expensive mistake is the optimistic "Yes." Vague or aspirational answers become contractual commitments; twelve months later your incident response programme has to exist exactly the way you described it. Write answers a CISO on the receiving side would respect: grounded in what is actually running today.

Step 3 — Cite evidence in every answer

"Yes" is weak. "Yes — access reviews run quarterly per our Access Control Policy, last completed in May" is strong, verifiable, and reusable. Citing as you go also builds the asset most teams throw away: the answer library.

Step 4 — Handle gaps with structure, not silence

Where there is no truthful "Yes," the right answer has three parts: No — compensating control we run today — roadmap to close it. Reviewers expect gaps. What they're really testing is whether you know yours. A defensible "no" reads as maturity; a hopeful "yes" reads as risk.

Step 5 — Keep the library

Every prospect's questionnaire is mostly the same questions in a different spreadsheet. If you keep your cited answers in one place, the next questionnaire — SIG, CAIQ, a cyber-insurance form, a bespoke vendor sheet — starts 70–90% answered. This is the difference between a recurring crisis and a recurring half-day task.

The mistakes that stall deals

• Letting the spreadsheet sit while you "find time" — the buyer reads silence as disorganization.
• Splitting it across five people with no owner — inconsistent answers are worse than slow ones.
• Copying last year's answers without re-verifying — drift turns old truths into new fiction.
• Treating it as a marketing document — reviewers are calibrated for puffery and discount everything after the first inflated claim.

When handing it off is the right call

If the deadline is days away, the questions outnumber your spare hours, or the answers live in heads that have no time — outsource it. ThinSky's Questionnaire Rescue reads the questionnaire and your real posture in parallel, drafts truthful answers that cite your controls, flags the genuine gaps before you commit them to writing, and hands back the library. Typical SIG: about 3 days. Introductory fixed price: $750.