The requirement arrived from outside, with somebody else's deadline attached.
A questionnaire, a framework, or a contract clause has landed, and it asks for documented controls rather than good intentions. The deadline belongs to the party who sent it, which usually makes it shorter than the work. The largest single lever is not effort: it is scope, because most of these requirements apply to a defined boundary, and getting that boundary right changes the size of the job more than anything else you do.
The visible problem is rarely the one that decides how this goes. These are the parts that are true whether or not anybody has said them out loud.
Every one of these regimes asks what you can show. A control that exists and is undocumented counts as absent, which is a documentation problem wearing a security costume.
Which systems, which data, which locations. A defensible narrow boundary is legitimate and is the difference between a quarter of work and a year of it.
The questionnaire is holding up a contract. That makes it a commercial deadline, and it should be resourced as one rather than queued behind the helpdesk.
The next customer will ask a version of the same thing. Evidence assembled once, kept current, answers most of them; evidence assembled per questionnaire never stops.
Somebody fills in the form as favourably as it can be honestly filled in, the contract proceeds, and nothing changes underneath. The next questionnaire is the same work again, and the first audit finds the gap between the answers and the estate.
Define the boundary, assemble the evidence from systems that already produce it, and answer from that. The second questionnaire then costs a fraction of the first.
The order matters more than the individual steps. Most of the cost in these situations comes from doing the right things in the wrong sequence.
The framework, the clause, or the questionnaire itself, rather than a summary of it. Requirements are usually narrower and more specific than the panic suggests.
In writing, with the party asking. This is the step that decides the size of everything after it and the one most often skipped.
What the systems can actually show today, against what the requirement asks for. The gaps are usually fewer and more specific than expected.
Ranked by what blocks the contract. Most requirements accept a documented plan for open items; none accept silence about them.
Each of these has a real answer and a plausible one. Knowing which you are giving is most of the job.
What exactly is being asked, by whom, and against which standard?
What is in scope, and has that boundary been agreed in writing?
What evidence can we produce today without doing any new work?
Which gaps block the contract, and which can be a dated plan?
