How long should a security questionnaire take?

Whatever it takes the first time, and materially less thereafter, if the first one produced reusable answers rather than a submitted document. Where the second takes as long as the first, the process is assembling from scratch each time, which is the thing worth fixing rather than the elapsed time itself.

Should I use a questionnaire automation tool?

It helps with the part that is genuinely repetitive, which is mapping a question you have answered before to a question phrased differently. It cannot help with the part that costs the most, which is that the underlying answer has changed since you last gave it. A tool that reuses a stale answer faster is not an improvement.

What if the questionnaire asks about AI we do not use?

Answer that you do not use it, and check the answer against your inventory rather than against your recollection. This is the question most often answered wrongly in good faith, because AI switched on inside a tool bought for another reason does not feel like AI you adopted.

How do you answer a security questionnaire about AI?

You answer a security questionnaire from records rather than from memory: each answer should be traceable to an artifact you could show if asked. The work is almost never in knowing the answers. It is in locating them under a deadline, keeping them consistent with what you said last time, and being willing to write "no" where the honest answer is no. An answer given from recollection is an answer you will have to defend later without knowing what you said.

Answer from artifacts, not from memory

For each answer, the useful discipline is to name the thing you would produce if the reviewer asked for evidence. Where that thing does not exist, the answer is not wrong, but it is an assertion rather than a claim you can support, and it is worth knowing which of your answers are which before somebody asks.

This is also the cheapest way to make the second questionnaire easier than the first. An answer with an artifact behind it can be reused; an answer somebody recalled has to be recalled again, by whoever is available that week.

Where two answers to different customers should match and do not, the cause is almost always that both were composed rather than looked up.

The answers that decay fastest

Anything naming a version or a model. Vendors move these without asking, so an answer that was exactly right can become wrong with nothing changing on your side.

Anything describing what a system is used for. Scope moves faster than paperwork, and a tool bought to draft internal notes that now drafts customer replies is a different answer under an unchanged description.

Anything with a number in it: retention periods, review frequencies, how many systems are in use. Those are the answers a reviewer is most likely to test against something else you said.

What to do about the ones you cannot answer

Say so, and say what you do instead. Reviewers read a great many of these, and a specific "we do not do this; here is what we do" reads as a functioning process. A vague affirmative reads as a process that has not been examined, and it invites the follow-up question you least want.

Where something is planned, give the date and treat the date as a commitment, because it will be quoted back at the next review.

An answer you cannot support is worse than a blank one. The blank costs you a question; the unsupportable answer costs you the reviewer's confidence in the rest of the document.

Consistency across the ones you have already sent

Keep what you sent. Most organizations do not, which means each questionnaire is answered fresh and the answers drift apart. Two customers comparing notes is rare; one customer sending an annual re-review is not.

The re-review is where a drifted answer surfaces, and the question that follows is not about the answer. It is about what changed and why nobody mentioned it.

Common questions

How long should a security questionnaire take?: Whatever it takes the first time, and materially less thereafter, if the first one produced reusable answers rather than a submitted document. Where the second takes as long as the first, the process is assembling from scratch each time, which is the thing worth fixing rather than the elapsed time itself.
Should I use a questionnaire automation tool?: It helps with the part that is genuinely repetitive, which is mapping a question you have answered before to a question phrased differently. It cannot help with the part that costs the most, which is that the underlying answer has changed since you last gave it. A tool that reuses a stale answer faster is not an improvement.
What if the questionnaire asks about AI we do not use?: Answer that you do not use it, and check the answer against your inventory rather than against your recollection. This is the question most often answered wrongly in good faith, because AI switched on inside a tool bought for another reason does not feel like AI you adopted.

Find out where you stand

The assessment on this site asks up to 24 questions about what makes your evidence stop being reproducible, and returns a score, a verdict and, where a control is short, the one thing to fix first. It names no framework, it takes about ten minutes, and where nobody outside asks, the two questions about somebody else's deadline and somebody else's reader are dropped rather than scored against you.

It is a self-assessment of whether what you can show today would still be showable later, not an audit, not a certification, not a conformity assessment and not legal advice. It says nothing about whether the practice it describes is adequate.

Run the assessment