I work on a couple of reasonably small products but generally government customers have a long list of questions (mostly but not entirely about security).