How long does it take to complete a cybersecurity questionnaire?
There is no fixed deadline prescribed for completing a cybersecurity questionnaire. The lead time in practice varies widely: from half a day if the answers are already available, to several weeks if information must first be gathered from various colleagues. The difference rarely lies in the questionnaire itself, but in how much of the answer is already documented somewhere.
Most delays do not occur when answering the questions, but when finding the right person within the company and verifying whether a supporting document is still valid. Those who know this can better estimate their own lead time than those who only look at the questionnaire itself.
What determines the lead time
Three things largely determine how quickly a cybersecurity questionnaire is completed. First: is this the first time your company receives such a questionnaire, or have you already answered similar questions for another customer? Companies encountering these questions for the first time must internally determine who can provide which answer. Second: are the underlying supporting documents already available, or must they still be requested from an IT supplier, an auditor or your own system administrator? Third: who within the company is authorised to confirm the answers on behalf of the organisation? In a sole proprietorship this is often one person, in a larger company questions about access control, backups and incident response go through different departments.
Where it often gets stuck in practice
The most common delay is not substantive but organisational: a question about password policy or access rights is forwarded to the IT manager, who only picks up the question days later because he does not know there is a deadline. A second common bottleneck is a supporting document that has since expired, such as a statement from an external IT provider or a summary of measures taken that no longer matches the current situation. A third bottleneck is that each customer portal has its own layout and terminology, so the same answer has to be rewritten each time in a slightly different format.
Much of this delay can be prevented by maintaining supporting documents and answers centrally rather than gathering them again for each questionnaire. in the knowledge base looked up by subject shows which are the most frequently requested areas and which supporting documents typically go with them.
What a cybersecurity questionnaire often asks
Many customers base their questionnaire, knowingly or unknowingly, on the ten measures mentioned in the NIS2 Directive. NIS2 is a European directive on the digital security of organisations; the ten measures cover, among other things, access control, incident handling, backups and the security of supply chains. Not every company falls under NIS2 itself, but many customers that do will translate these topics into the questionnaire they send to their own suppliers. This explains why similar questions recur with different customers, even if your company does not itself fall directly under the directive.
What you can do yourself
The lead time becomes significantly shorter if it is clear who within the company can answer which part, and if supporting documents are kept in one place with a clear validity date. This does not mean that every questionnaire is completed at once with this: each portal asks its own questions in its own order, and a customer can always ask for additions. What does help is that you do not start from scratch with the same overview of measures and supporting documents each time a new questionnaire arrives.
To see which topics are relevant to your situation, you can see where you stand in a few questions. Anyone who wants to know how a system like supplia.eu arrives at an answer without anyone reading along or making any assessment will find that explained on the page where the information comes from.
Finally
How long it takes to complete a cybersecurity questionnaire depends mainly on internal preparation, not on the questionnaire itself. If you have doubts about a specific question from a client or about what is legally expected of your company, consult the text of the directive or a lawyer; supplia.eu does not provide an assessment of individual situations. For general questions about how the platform works, an overview is available on the FAQ page. If you would first like to see whether your situation aligns with the topics that buyers usually ask about, the free quick-scan can be a good starting point.