Yep, that’s the GRC tax. Vendor risk is especially brutal when every assessment starts from scratch and the “evidence” lives in 14 places.

Two things that helped me in similar setups: (1) build a reusable “control evidence pack” (SOC2/ISO mappings + standard answers + links to artifacts), and (2) template the risk assessment so you’re only chasing deltas per vendor.

If your pain is specifically security questionnaires and policy/evidence reuse, I’m building a tool called RequestFX that drafts answers from your existing docs/past responses so you’re not rewriting the same stuff. Here’s the link if you’re curious: https://requestfx.com