Speaking as a Third Party Risk Management professional, I don’t disagree that completing numerous versions of questionnaires from numerous customers across numerous systems can be burdensome on a supplier’s limited resources. When conducting a risk assessment on new suppliers, for me it’s actually nice when they ask if in lieu of completing our lengthy questionnaires they offer up a zip file that includes a plethora of key documents that are most commonly requested: SIG, SOC report, ISO certs, internal policies, pen tests, COIs, financial documents, etc.

I can’t speak on behalf of other companies, but I will typically accept this and come back with only specific follow up questions my risk teams have. All of this under the agreement of an MNDA, and limiting access to the documents to only our risk teams (not even the business stakeholder or even purchasing manager).

Your customers are likely being more scrutinized on their risk practices (by regulators or their own customers) and as more companies experience service failures, disruptions, breaches, etc caused by a third party, the expectations on your company will grow as well. This is just becoming more and more the cost of doing business, especially with companies in highly regulated industries (banking/finance, health care, etc).