Typical elapsed times
These are working estimates from teams answering questionnaires regularly. Elapsed time, not effort: the gap between the two is the point of this guide.
- A vendor onboarding form of 30 to 60 questions: half a day if the answers exist, three to five days if they have to be written and approved.
- A customer's own security questionnaire of 100 to 200 questions: two to three days with a library, one to two weeks without.
- A full SIG or a long DDQ, several hundred questions: two to three days with a current library, one to three weeks from scratch.
- A repeat questionnaire from the same customer a year later: a day, if last year's answers were kept and dated.
Where the time actually goes
Writing is a minority of the elapsed time. In most teams the hours split roughly like this: finding the last answer to the same question and checking it is still true; waiting for the person who knows (the infrastructure lead, legal, HR) to reply; chasing a document that exists somewhere; reconciling two answers that contradict each other; and formatting the answers back into the customer's spreadsheet. Then, at the end, one person reads the whole thing for consistency and finds the contradictions the process missed.
The writing, the part people picture, is often under a fifth of it.
What cuts it, in order of effect
An answer library with dates. The single biggest change. If the approved answer to "how often are access rights reviewed" exists with a date and an owner, the question takes a minute. See how to build one.
One owner who can approve. Every hand-off adds a day. A coordinator who can approve most answers, and who only escalates the few that need a specialist, turns a two-week questionnaire into a three-day one.
Answering in the customer's file. Reformatting at the end costs hours and introduces errors. Fill the column they gave you, in the sheet they gave you.
Evidence that is already current. A missing certificate or an expired test report can hold a finished questionnaire for a week. Keep evidence dated in the same library as the answers.
Drafting the first pass automatically. With a library in place, a tool can draft every row from it, mark which drafts are well supported and which are not, and leave your team with a review rather than a blank sheet. The review of two hundred drafts takes hours; writing two hundred answers takes days.
What does not cut it
Copying last year's file forward without reading it. It is fast until the reviewer finds the answer that describes a system you replaced, and then the whole questionnaire is under suspicion. Speed comes from answers that are current, not from answers that are quick.
In numbers, with a tool
Teams using Responsemate report the first pass of a 200-question questionnaire drafted in minutes, with the sources shown on each answer, and the review taking a few hours spread over one or two days, most of it on the answers the tool flagged as weakly supported. The hours-saved figure is on the dashboard, computed from the questionnaires actually completed. How the questionnaire flow works.
Questions people ask
How long does a SIG take to complete?
A full SIG answered from scratch takes a small team one to three weeks of elapsed time. With a current answer library it is two to three days, most of it review.
Can a security questionnaire be answered in a day?
A short one, yes, if the answers already exist and the person answering has authority to approve them. The delay in most questionnaires is waiting for someone, not writing.