Ignore clients who bring you more worries than money. Hire someone to answer these questions. If the income from such clients does not cover the salary of such a person, ignore such clients. Another approach is to create a template document describing your security practices based on an analysis of such questions, and send it in response to such questionnaires with a cover letter saying that you are very sorry, but answering the questions takes too much of your time and it'll be a pity to lose a client if this PDF is not enough for him. In any case, all that paper exists to cover someone's ass, no one will read your answers.