Why the questionnaire arrives
A client, a prospect, or a firm you already serve sends a spreadsheet, a portal, or a long PDF. The reason is practical. They are deciding whether to sign, whether to renew, or whether their own examiner will accept you as a vendor. Law firms see it when a corporate client makes continued work contingent on the answers. A small SaaS company sees it as a condition of the contract. An adviser sees it from an institution that will not refer or custody assets without a review.
What “credible” means
Credible is not the same as complete, and it is not the same as impressive. A reviewer is trying to learn whether access is limited, whether you would notice if it were not, whether you know who else holds the data, and whether anyone has written down what happens on a bad day. An answer that says yes, with no owner and no artifact, is weaker than an answer that says not yet, here is what we do instead, and here is when the gap closes.
Triage before you draft
Read the questionnaire once for themes, not for a score. The forms tend to ask about the same subjects, whatever the logo on the cover: identity and access, logging, vendors, incident response, and how data is handled. Map each question to one of those. Where three questions are the same question in different clothes, write one answer and reuse it. Where a question does not apply, say why in a sentence.
What you should be able to produce on Monday
You do not need a binder. You do need a short set you can send without writing it from a blank page under the deadline:
- Who administers identity, and whether a second factor is on for email and for the systems that hold client data.
- How someone is granted access, and how a departure is removed.
- Where the important data lives, and which vendors hold a copy.
- Whether logs exist for the systems that matter, and who is responsible for looking at them.
- A written incident response plan with names, not “the IT person.”
- The policies you will stand behind: acceptable use, access, and how data is handled.
If a line is missing, the honest answer is that it is missing, plus the date you will close it. Many law-firm engagements start here, because the questionnaire is the trigger and the documents are the work.
When a template pack is enough
A template is enough when the questions are standard and you can answer them from how you already work. The Vendor Questionnaire Response Pack is a set of drafted responses and an evidence index you edit to the firm. It is $399, and the purchase is credited in full toward an advisory engagement booked within 90 days. It is a starting point for the questionnaire on your desk. It is not a certification.
It is the wrong tool when the portal is bespoke, the deal is large, or the reviewer has already sent a second round. That work is scoped: questionnaire support, quoted to the date on the email rather than to a catalog page. The same is true when the honest read is that the answers would be guesses. In that case the first engagement is a security maturity assessment, $3,000 to $8,000, scored against NIST CSF 2.0 with the gaps ranked, so the questionnaire is answered from evidence instead of from hope.
Scoped to a date
TRM starts from the deadline and the document in front of you. A fixed-scope engagement names what will be drafted, what you will have to confirm, and what done means: answers submitted, or answers plus the evidence a reviewer is likely to ask for next. If the shorter path is the response pack, we say that. If the shorter path is a person for two weeks, we say that too.
The free readiness assessment is the same read, directional, about five minutes. It is not the client deliverable. It will tell you whether you are guessing.