Security questionnaires

Long questionnaires generate enormous effort and weak assurance.

They are answered by a sales team from a library of previous answers, reviewed by somebody with no way to verify any of it, and filed. Both sides know this. A short set of questions about the specific integration, backed by evidence and a right to test, produces more assurance than three hundred yes-or-no boxes.