The security questionnaire almost never arrives when you have time for it. It arrives attached to a contract you want, with a deadline, and it asks forty questions in language written by someone who has never seen your network.
The expensive version of that moment is discovering the answer is no. The cheap version is knowing already.
What a readiness review actually is
It is a review against the framework you are being held to, producing a list of what is in place, what is not, and what it would take to close each gap. Not a penetration test, not a certificate, and not a promise you will pass anything — an accurate picture, written down.
For most organisations the framework is chosen for them: a public-sector client names one in the contract, an insurer names one on the renewal form, a prime contractor passes theirs down. Working out which one applies to you is part of the exercise.
Gap list or full review
A gap list tells you where you stand. It is the right scope when you need to answer a questionnaire honestly and prioritise, and it is quick.
A full controls review goes further: every control examined, evidence noted, and a remediation plan with an order of work. That is the right scope when someone is going to audit you rather than ask you, or when you have decided to fix things properly rather than answer questions.
An external vulnerability scan can be added to either. A penetration test is a different kind of engagement and we quote it with a person involved, because its scope decides everything about what it costs and what it is worth.
Where the gaps usually are
Not in the firewall. In the boring inventory:
Nobody knows how many devices there are. You cannot claim patching you cannot evidence, and you cannot evidence patching on machines you have not counted.
Leavers still have accounts. This one appears in almost every review and is almost free to fix.
Backups exist and have never been restored. An untested backup is a belief, not a control.
Two-factor is on for the people who volunteered. Coverage is the control; enthusiasm is not.
There is no written answer to "what do we do if". Incident response does not need to be elaborate. It needs to exist before the incident.
What to do with the result
A gap list is worth having even if you fix nothing immediately: it turns forty vague questions into a short list with owners and an order. Most of it is configuration and discipline rather than purchase, and the parts that do need buying are easier to justify when they are attached to a named requirement.
If you would rather the fixing was done than listed, most of it is work we do — device management, patching, backup, access review. The review tells you which of it you actually need, which is the point of doing it first.