How to Answer a 300 Question SIG in Under Five Business Days

The prospect promised a 90 day evaluation. Their procurement team just sent a 300 question SIG on day 60. The security engineer who could answer it fastest is on parental leave. The deal is scheduled to close in eight weeks.

You have a week. This is how to actually deliver.

What are the tiers of questions in a 300 question SIG?

Before anyone drafts a word, sort all 300 questions into three tiers on day one. This is the single highest leverage two hours of the whole workflow.

• Tier 1: Boilerplate corpus questions. 60 to 70 percent of most SIGs. These are the standard control questions your knowledge base already answers: encryption at rest, incident response process, backup cadence, access review frequency. High confidence drafts from the corpus, minimal review.
• Tier 2: Corpus with context needed. 20 to 30 percent. Answers exist but need prospect specific tailoring: architecture diagrams, data flow specifics, subprocessor listings for the regions the customer operates in.
• Tier 3: Genuinely new questions. 5 to 15 percent. Novel or unusually deep questions requiring senior engineering input or explicit control verification. This tier is where the timeline actually lives.

Never draft in question order. Always draft in tier order, starting with Tier 3 because it has the longest lead time.

How should the week actually be structured?

A five day plan that assumes the questionnaire arrived Monday morning.

The critical rules: Tier 3 goes first, not last. Review is one named person, not a committee. The cutoff is real.

Who does what and why?

Three roles, no more.

1. GRC lead. Owns the workflow end to end. Runs the triage, drafts Tier 1 and Tier 2, coordinates SME input, packages the final. This role is why the timeline works, because there is one throat to choke.
2. Senior security engineer. Owns Tier 3. Roughly 8 to 12 hours across the week, mostly on day one and two. Reviews Tier 2 architecture questions in day three.
3. Named senior reviewer. Usually the head of security or CISO. Owns the day four review pass. Typically 3 to 5 hours. If they cannot commit that window, the timeline slips.

Everybody else is a batched SME. IT, legal, and DevOps get their questions routed on day one with a day two response deadline. They do not attend meetings. They answer async.

How do you handle the citation and confidence workflow?

Every drafted answer, every tier, needs three things attached before the reviewer sees it.

• The direct citation. Which policy, SOP, or audit report supports the answer. Not "our security team confirmed"; the actual document and section.
• A confidence signal. High if the citation is a signed policy or audit report. Medium if it is an engineering document or Slack decision. Low if it is uncited or freshly written for this questionnaire.
• The reviewer's decision. For medium and low confidence answers, the reviewer either signs off explicitly or the answer is escalated.

The reviewer's job is not to reread every high confidence answer. It is to spot-check the high confidence tier, deeply review the medium tier, and gate the low tier. This is what compresses review into an afternoon rather than a week.

What about the prospect clarification round?

Roughly 5 to 15 followup questions will arrive 3 to 7 business days after you submit. Plan for them, or your five day submission turns into a three week deal delay.

• Reserve half a day. Block time on the GRC lead's calendar the week after submission.
• Answer within 48 hours. Slower response signals a slow security program, which is the wrong signal in a late stage deal.
• Escalate to the reviewer. Followup questions are almost always about the medium confidence answers. Loop the original reviewer, not a new person.
• Capture the delta. Every followup answer that was not already in the corpus goes into it. This is where the corpus actually improves.

The clarification round is where deals close, not where they open. Treat it accordingly.

Which tools actually save time in a five day cycle?

A short list. Everything else is decoration.

• A structured answer corpus with search that surfaces citations, not just text. This is 40 to 60 percent of the timeline compression.
• A drafting tool that inserts high confidence drafts inline in the questionnaire format, so the GRC lead is editing rather than writing. This is another 20 to 30 percent.
• A review tool with an approval trail per answer, not per document. This is what allows the reviewer to work in parallel with the GRC lead on day four.
• A questionnaire portal integration if the buyer uses OneTrust, Whistic, or ServiceNow. The alternative is manual re-entry of 300 answers, which costs a full day.

Not on the list: shared Google Docs, email threads, Slack channels named after the deal. Those are how five day cycles become three week ones.

The mistake to avoid

Most teams try to answer a 300 question SIG the way they answered the 40 question one, just with more people. That does not scale. The five day cycle requires a different workflow: triage before drafting, batched SME input on day one, a single named reviewer on day four, and a corpus that surfaces citations rather than just text. Add people to the wrong workflow and you get slower, not faster. Fix the workflow first, then decide if you need the headcount. Usually you do not.