Good advice. I've filled in dozens of those questionnaires from big corps on behalf of clients, and they can be gruelling, but in general the infosec team on th

Good advice. I've filled in dozens of those questionnaires from big corps on behalf of clients, and they can be gruelling, but in general the infosec team on the other end are usually cooperative / collaborative - eg. they'll often take a "we'll work on this" or "we don't need this because X" over "won't fix". The most important thing is committed spend - eg. it's common for Big Corp Inc's infosec team to put you through compliance, potentially asking you to spend $0000's on time and services, without comparing that to the value of the contract you could have with them. You could spend a lot based on zero commitment it you take your eye off this.