The pattern in the questions
Strip out the industry-specific parts and what remains is remarkably consistent. Who is responsible for this. How long has that been the case. What happens when it fails. How would we know. Can you show us rather than tell us.
Almost every one is about duration or evidence. Very few are about the current state, because the current state is easy to assert and therefore proves little.
Why they ask this way
Procurement is not trying to establish that you are competent today. They are trying to establish that you were competent last year and will be next year, because the contract is going to run for a while and the person assessing you will be held responsible for the choice.
An assurance transfers no risk. Evidence does, which is why the questions push towards things that can be checked.
What this costs when you have no record
An hour or two per questionnaire, assembling answers from registrar emails, old invoices and memory. Multiply by every prospect above a certain size and it becomes a real drag on the sales cycle. Worse, it often arrives at the point where the deal is nearly closed, so the delay is expensive in a way that is hard to attribute.
What a link changes
The answer stops being assembled and starts being pointed at. More usefully, it stops being your word: the person assessing you can open it themselves, which is a materially stronger position than being believed.
It also handles the duration question, which is the one you cannot otherwise answer well. "It has been verified without a break since March 2023" is a different kind of statement from "yes, we monitor that".
The limit worth stating
None of this replaces a formal security review at the top end, and it does not substitute for SOC 2 or ISO 27001 where those are actually required. It answers the basic layer that arrives long before those do, and for most businesses the basic layer is the entire interaction.