You answer enterprise security questionnaires from a maintained set of control documentation, not from scratch each time. The questionnaire isn't a one-time event, so the goal is a reusable system rather than a faster scramble.
What they ask, and how often
Once you sell to enterprise, security review is a permanent part of the sales cycle. Every new customer runs their own, and existing customers re-run them at renewal. The questions themselves are reasonably predictable: data handling and retention, access controls, encryption in transit and at rest, vulnerability management, incident response, vendor and subprocessor oversight, audit history.
What it actually costs you
The visible cost is the hours spent filling in the document. The one that hurts is whose hours they are. Questionnaires arrive on the customer's schedule and pull the few people who know the answers off whatever they were doing, once per new deal and again at every renewal.
What to do instead
Answer the underlying questions once and maintain the answers. That means a documented control set covering the recurring categories, evidence you can produce on request rather than assemble on request, and language already translated into what a security reviewer and a procurement reviewer each need. Different audiences, same facts, and doing that translation is a large part of the work I take on here.
A Type 2 report is the strongest version of this, because the answers arrive with an auditor's name on them instead of yours. That's a good part of why companies pursue the audit at all.
One caveat. If the answers reveal controls you genuinely don't have, documentation won't paper over it, and the work becomes implementing them, which is SOC 2 audit readiness territory.
For why the questions keep coming and keep growing, The Security Questionnaire Problem goes into it; the engagement itself is Fractional Cybersecurity Program Lead.