A first security questionnaire at a small SaaS company typically takes two to three weeks of part-time work spread across several people. The second, if you kept the answers properly, takes a fraction of that — often two or three days. The variable that dominates is not the length of the questionnaire. It is whether you have answered one before and where you put the answers.
This article covers realistic ranges by scenario, where the time actually goes phase by phase, the three things that consume far more of it than people expect, why the second questionnaire is so much cheaper, and how to give a buyer a date you can hold.
Realistic ranges
Treat these as planning estimates rather than promises. The spread is wide because the inputs vary enormously.
Short questionnaire, existing documentation. Thirty to eighty questions, answers already written down. One to two days of one person's time, plus a short engineering session.
Standard assessment, first time. A hundred to two hundred questions with no prior answer bank. Two to three weeks elapsed, perhaps five to eight person-days of actual work spread across three or four people. Most of the elapsed time is waiting rather than working.
Core-tier assessment, first time. Several hundred questions expecting narrative answers, plus a document pack. Three to five weeks elapsed. This is the scenario that surprises people, and it is worth naming as a risk to the deal owner early.
Repeat assessment with a maintained answer library. Two to four days regardless of length, because the work has become mapping rather than research.
Vendor portal with no bulk import. Add thirty to fifty percent to any of the above. Web forms that cannot be drafted offline, do not save reliably, and require answers to be pasted one field at a time are a real and frequently underestimated tax.
Where the time goes
Five phases, in the order they happen.
Triage — one to two hours. Read the whole questionnaire, count the questions, sort them by who can answer, identify the document requests, establish the real deadline. Skipping this is what turns a bounded task into an open-ended one.
Transcription — the largest block, and the least skilled. Roughly half of a typical assessment is writing down things that are already true and already known. This is where a non-technical owner does most of their work, and it is the block that shrinks most dramatically on repeat questionnaires.
The engineering session — ninety minutes to three hours. The flagged questions that require judgment. This should be a scheduled block with someone else typing, not an assignment. Run as an assignment, this phase alone routinely consumes two to three weeks of elapsed time.
Evidence gathering — days of elapsed time, hours of work. Requesting documents from vendors, locating policies, pulling configuration exports, getting an insurance certificate reissued. Almost none of this is your effort and almost all of it is calendar time, which is why it has to start on day one.
Review and return — two to four hours. Reading the whole thing for internal consistency, checking that no answer contradicts another, and packaging it. Genuinely worth doing, because contradictions are what reviewers catch and escalate into a second round.
The three things that take longer than expected
Finding evidence. Reviewers ask for backing on perhaps a fifth of answers, and the delay is almost never writing the answer — it is locating the document, the screenshot, or the vendor certificate that proves it. A team that knows exactly where its subprocessor DPAs live answers in an hour. A team that does not spends three days emailing vendors.
Waiting on other people. Your cloud provider's compliance documentation, your insurer, your penetration testing firm, the contractor who set up your monitoring two years ago. Every one of these is a multi-day round trip you do not control.
Deciding what an answer means. Questions like "is all data encrypted at rest" look binary and are not, once you consider backups, logs, search indexes, and analytics pipelines. The honest answer requires a conversation, and that conversation is genuinely valuable, but it is not fifteen seconds of work. Expect a handful of these in any real assessment.
Why the second one is so much faster
Because the expensive part of the first questionnaire is not answering questions. It is discovering, in writing, what your company actually does — often for the first time.
That discovery does not have to be repeated. What has to happen is that the output gets stored somewhere retrievable by topic rather than by customer. A completed workbook filed under a client name is a document you will never open again; the same answers organised by subject turn the next questionnaire from research into retrieval, which is a task a non-technical person completes at speed.
The multiplier is large. Teams that maintain an answer library commonly report repeat questionnaires taking a fifth of the time of the first, and the reason is arithmetic rather than skill: the transcription block collapses, the engineering session shrinks to a handful of genuinely new questions, and evidence gathering becomes a matter of checking dates. Our guide to building a reusable answer library covers how to construct one from the questionnaires you have already completed.
The other half of the saving comes from publishing. Anything sitting at a public URL — your DPA, subprocessor list, retention policy, security overview — is an answer supplied as a link rather than a paragraph, and one the buyer can verify without asking you.
Giving a date you can hold
Four rules.
Do not quote before you triage. An hour of sorting tells you whether this is two days or three weeks. Committing first and discovering after is how vendors miss dates on deals that were going well.
Ask what the real deadline is. The stated date is frequently an analyst's internal target rather than a hard stop. Asking for an extra week at the start is trivially easy and costs nothing; asking on the due date costs credibility.
Quote elapsed time, not effort. "Five days of work" means nothing to a buyer waiting on a calendar. Give them a date, and build in the evidence-gathering delays you do not control.
Add a buffer for the second round. Anything larger than a Lite generates follow-up questions. If the deal timeline assumes submission is the end, the deal timeline is wrong.
Common mistakes estimating questionnaire time
Quoting a date before opening the file. Length, tier, format, and document requests all vary per buyer. Triage first.
Estimating effort instead of elapsed time. Most of the calendar is waiting on vendors and on scheduling, not typing.
Treating the engineering block as an assignment. As an assignment it takes weeks. As a scheduled session with someone else typing, it takes hours.
Forgetting the document pack. Insurance certificates, vendor attestations, and penetration test summaries have lead times you do not control. Start on day one.
Assuming submission ends it. Follow-up questions are normal on anything substantial. Budget for a second round.
FAQ
How long does it take to complete a security questionnaire?
A first assessment of one to two hundred questions typically takes two to three weeks of elapsed time and five to eight person-days of work. With a maintained answer library, the same questionnaire is usually two to four days.
Why do security questionnaires take so long?
Most of the time is not spent writing answers. It goes on locating evidence, waiting for documents from vendors and insurers, scheduling engineering time, and resolving questions where the honest answer requires a decision rather than a fact.
Can I ask a buyer for more time on a security questionnaire?
Yes, and the stated deadline is often an internal target rather than a hard requirement. Ask at the start rather than at the end — an early request for two extra weeks is routine, while a request on the due date is remembered.
How can I complete security questionnaires faster?
Triage before answering, run engineering time as a scheduled session rather than an assignment, start evidence gathering on day one, keep answers organised by topic rather than by customer, and publish the non-sensitive portion so it can be supplied as a link.
Closing thought
The honest framing for a founder is that the first questionnaire is a one-time cost being charged to a specific deal. It feels disproportionate because it is: you are paying to document your entire security and privacy posture, and the invoice happens to arrive attached to one customer. That is genuinely unfair to that deal and genuinely useful to the company.
What determines whether you pay it again is entirely down to where the answers end up. ComplyDog keeps the recurring half — DPA, subprocessor list, data subject request handling, security overview — published and current on a portal at your own domain, so the next questionnaire opens with a section already answered and a buyer who can check it without emailing you. The first one will still take two weeks. The fourth one should not.
