Start by writing down what you already do
A ten-person company has more security practice than it has security documents. Laptops are encrypted because the operating system does it; access is granted by one person who knows everyone; backups run because the hosting provider runs them; code is reviewed because two people look at every change. None of this is written down, and a questionnaire asks for exactly that. Spend the first morning writing one page per area: who has access to what and how it changes, how code gets to production, where data lives and how it is backed up, what happens if someone loses a laptop, what happens if the service goes down. Plain sentences, the current truth. That page is your policy for the questionnaire, and the seed of the real one.
Lean on your providers
Most of your infrastructure security is your hosting provider's, and they have answered these questions publicly. Their compliance pages, their published questionnaires and their certifications answer the physical security, data centre, encryption at rest and availability questions for you. Quote them by name and add the one sentence about what you configure on top: which region, which encryption setting, who holds the keys. The same applies to your e-mail, payment and identity providers.
Say what you do not have, and when you will
You will have gaps: no penetration test yet, no formal incident plan, no security training programme. The answer that keeps the deal alive is specific: "No external penetration test has been performed; one is scheduled for the fourth quarter with a named provider. Dependencies are scanned on every build." Reviewers at large customers have a process for accepting vendors with gaps and a plan. They do not have one for vendors who claimed to have no gaps and were found out.
Keep the first questionnaire; it is your library
The 180 answers you write this week are most of the answers to the next questionnaire, and the one after. Keep them somewhere better than the sent e-mail: one place, with the date, and a note of who confirmed each. When something changes (you hire, you move region, you get the test done) update the one answer it affects. The second questionnaire takes a day instead of a week, and the third takes an afternoon.
Get the three documents that unlock most deals
If you write only three documents this year, write the information security policy (the one-pagers above, tidied into a single document with an owner and a review date), the incident response plan (who decides, who tells customers, within what time), and the sub-processor list with a data processing agreement template. Those three answer the questions that block procurement most often.
When it is time for a tool
When questionnaires arrive faster than one person can answer them from memory, a tool built for the job turns the library into drafts and keeps the dates. Responsemate is used by small teams for exactly this: import the customer's file, draft every answer from the one-pagers and the last questionnaire, review the ones it marks as unsure, export in the customer's format, and keep everything for the next one. How a small vendor uses it.
Questions people ask
Do we need ISO 27001 to sell to large customers?
Not usually, but you need to answer their questionnaire well. Many customers accept a small vendor without certification if the answers are specific, honest and backed by the few documents that matter. The certificate becomes worth its cost when the questionnaires start arriving every week.
What if we answer "no" to a lot of questions?
Answer "no" and say what you do instead, or when you plan to. A reviewer would rather see fifteen honest gaps with dates than fifteen vague yeses. Vague yeses are what fail audits later.