each customer has a different security questionnaire do I have to start over each time

Every list is a different order of the same ten measures

No, in most cases you don't need to start from scratch — the questions differ in wording, but they cover virtually the same underlying points for almost every customer. One bank asks about "incident response procedure", another about "how security incidents are handled", and a third about "detection and reporting of cyber incidents". That is three times the procedure for handling security incidentsthree times the same answer from the same file. The same applies to access, backups, vulnerability management and supply chain security with suppliers: virtually every questionnaire reduces to a subset of the ten measures from article 21(2) NIS2, even if the customer does not themselves refer to NIS2.

The work therefore lies not in repeatedly reformulating answers, but in recognizing which question belongs to which underlying point. A question about "password policy and two-factor authentication" is simply multi-factor authentication in other words. A question about "supplier risk" or "third party risk" is security requirements for own suppliers. Once that file is in place, every subsequent list is mainly matching and confirming, not rewriting.

Where that is based on: article 21(2) and Annex A

Article 21(2) of the NIS2 Directive (2022/2555) lists ten categories of measures — risk analysis, incident handling, business continuity, supply chain security, vulnerability policy, cryptography, access policy, MFA, awareness and testing of measures. Virtually every security questionnaire from a bank, insurer or major customer is their own translation of (part of) those same ten points, often supplemented with questions taken literally from Annex A of ISO/IEC 27001. This explains why the wording varies but the underlying content does not: they are two fixed frameworks, not a thousand separate customer requirements.