Nobody Owns Security Questionnaires (And That's the Real Problem)
Ask a twenty-person SaaS company who owns security questionnaires and you get a pause.
Sales owns the deal. Engineering owns the systems. Someone, often a founder, owns compliance in the sense that it is on their list. The questionnaire itself belongs to none of them, which is why it takes three weeks instead of a day.
What actually happens
A questionnaire arrives attached to a deal. Sales forwards it to whoever answered the last one. That person opens it, answers the sixty percent they know, and gets stuck on the rest.
Then the slow part starts. The encryption questions go to the infrastructure lead, who is mid-sprint. The sub-processor questions go to whoever set up the vendor spreadsheet, who has left. The business continuity questions go to a founder who improvises an answer that will be contradicted by the next questionnaire.
Each round-trip costs a day. Four round-trips and the deal has slipped a week for reasons no one can point at.
The questions were never the bottleneck. The routing was.
Why it does not get fixed
Because it is nobody's job, it never gets a process. And because it never gets a process, three things stay true:
Answers are not kept. They live in whichever spreadsheet they were written in, in someone's Sent folder. The next questionnaire starts from nothing.
Answers drift. The same question gets a different answer depending on who was asked and when. Two customers now hold contradictory descriptions of your security posture. Nobody will notice until one of them is doing diligence during an incident.
The bottleneck is invisible. Nobody logs the four days spent chasing the infrastructure lead, so it never appears as a cost worth fixing.
What ownership would look like
It does not need a hire. It needs three decisions:
One person is accountable for the answer set. Not for writing every answer, but for the set existing, being current, and being consistent. Usually whoever already carries compliance.
Answers live somewhere that is not a spreadsheet. The specific tool matters less than the property: an answer corrected once should be corrected everywhere, and you should be able to see which answers are stale.
Experts are asked in batches, not one at a time. Ten questions for the infrastructure lead is one conversation. Ten separate messages over four days is four days.
The compounding argument
The first questionnaire is expensive whatever you do. The tenth should not be.
If you keep and maintain the answers, questionnaire ten is a review. You check the twenty percent that is genuinely new and confirm the rest still holds. If you do not, questionnaire ten costs the same as questionnaire one, forever, and every one of them is a fresh chance to contradict yourself.
That gap is the entire return on treating this as a process rather than an interruption.
FillTrust routes questions to experts in batches, keeps every approved answer, and tells you which of them are being reused. See how it works.