Security questionnaire

01Common standard questionnaires

• SIG (Standardized Information Gathering): Shared Assessments' questionnaire for third-party risk management, mapped to widely used security and privacy frameworks.
• CAIQ (Consensus Assessments Initiative Questionnaire): the Cloud Security Alliance's yes-or-no questionnaire built on its Cloud Controls Matrix, used for cloud services. Vendors can publish a completed CAIQ in CSA's STAR registry.
• HECVAT (Higher Education Community Vendor Assessment Toolkit): EDUCAUSE's questionnaire for vendors selling to colleges and universities.

Many large companies send their own questionnaires instead, often hundreds of questions drawn from these and from their own policies.

02Evidence they expect

Answers carry more weight with evidence: an independent SOC 2 Type II report under the AICPA's trust services criteria, an ISO/IEC 27001 certificate, penetration test summaries, and policies for access control, encryption, incident response, business continuity and vendor management. Some buyers accept a current SOC 2 report or a published CAIQ in place of much of their own questionnaire, so offer them early.

03Answering well

• Where the format allows, answer yes or no first, then explain.
• Never answer yes for a control you do not have. Answers often become contractual representations.
• Keep one approved answer set, owned by the security team and reviewed on a schedule, with the source policy or report noted for each answer.
• When the honest answer is no, explain any compensating controls.
• Keep the answers consistent with your DDQ responses, marketing claims and contract terms.

Security questionnaires often arrive with or inside an RFP and can decide the outcome on their own, so plan them into the schedule rather than treating them as paperwork. The SIQ explainer covers the broader supplier questionnaires they often travel with.