Every vendor selling into security reviews sells the same fix: draft the next questionnaire faster, cite a document on each answer, assign an owner, track a status. That work matters, and the security questionnaire response pack is built around it. None of them price the thing that actually stalls a deal, though, which is rarely the buyer. It is one unanswered item sitting in one engineer's queue, next to a sprint that already has a number attached to it, and a day count never wins that argument.
So this tracker prices every blocker the way the roadmap already prices its own backlog: the deal's ACV divided by the engineering hours the fix actually needs. That is a cost-of-delay-over-job-duration ratio, the same logic the Scaled Agile Framework's WSJF formula uses to sequence work. In the worked example below, a one-hour fix behind a $72,000 deal prices at $72,000 an hour, eighty-one times the rate of the company's own named roadmap commitment. Five blockers worth $836,000 combined clear in thirty engineering hours, under one person's week.
Not every blocker has an engineering-hours dial to turn. A pen test booked through an outside vendor needs a minimum lead time no amount of internal urgency compresses. So the register tags it vendor-bound and routes it to a different action: expedite the vendor, or reset the buyer's expected date before the target close date arrives unannounced. The documents a resolved blocker eventually becomes evidence inside sit in the trust package.
Vendor Security Review Tracker Template