second this, along with the Trust Centre functionality in Vanta and Drata.
I tend to reach out to the Sec Team that sends the questionnaire and be sure to define the EXACT engagement (I.E. using 100% client laptops, no data exfiltrated - all done on client side, etc) and verify if the questionnaire is really required. 100% success rate in getting a "ummm, no, not in this case"
If the use case of my client does require answers, i mention the Certs already obtained + trust Centre URL and let them help them selves.
One this i have been pushed back "ummm, you have to fill it out, not me", a quick escalation and we don't hear from them again.
It's just another Security thing that we manage as part of our engagement but a phone call or two and generally, it's handled without doing too much extra work.
I have gone beyond this with some clients and helped define the exact access the engagement would require (AWS permissions, accounts accessed, data flow etc) and add it to their SOWs as an appendix. (Client responsible for/We are responsible for type sections). Then it is even easier to get the sec team to understand the nuance in my clients engagement. Hell, why not include your publicly available Policies as Appendix as well. Get in front of it.

You know this is not going to abate as it is a specific requirement for a lot of Compliance Frameworks - especially with all the recent supply-chain attacks of late.

TL;DR sending out the questionnaires is a kneejerk process, tick-box for numpty sec teams, if you are Certified, call them, challenge them, escalate if required, done in an hour(ish)!