What is a security questionnaire?
A security questionnaire is a set of questions an organization sends a vendor to assess its security practices. Common standards include SIG and CAIQ. Here's how to answer them efficiently.
A security questionnaire is a structured set of questions an organization sends to a vendor, or a potential vendor, to assess its security and privacy practices before and during the relationship. Common standard versions include the Shared Assessments SIG and the Cloud Security Alliance CAIQ, and many companies send their own. Answers are usually backed by evidence like a SOC 2 report or policies.
Common questionnaires
| Questionnaire | From | Notes |
|---|---|---|
| SIG and SIG Lite | Shared Assessments | Broad third-party risk coverage, with Lite as a shorter version. Updated yearly. |
| CAIQ | Cloud Security Alliance | Aligned to the Cloud Controls Matrix, for cloud providers |
| HECVAT | EDUCAUSE | Used by colleges and universities to assess technology vendors |
| VSA questionnaires | Vendor Security Alliance | Free questionnaires from a consortium of technology companies |
| Custom | Individual customers | Often a spreadsheet that mixes standard and custom questions |
Why they exist
When a company buys software or services, it takes on some of the vendor's risk. Regulations and frameworks require the buyer to check vendors before sharing data, and a questionnaire is the standard way to collect answers at scale. For the vendor, questionnaires are part of every enterprise sale. A slow or weak response can stall a deal for weeks.
What they ask about
- Governance: security policies, roles, risk assessments, and board oversight.
- Access control: SSO, MFA, least privilege, access reviews, and offboarding.
- Data protection: encryption in transit and at rest, key management, data retention and deletion.
- Infrastructure: cloud providers, network security, logging, and monitoring.
- Application security: secure development, code review, testing, and vulnerability management.
- Incident response and business continuity: plans, testing, and notification timelines.
- Third parties: how you manage your own vendors and subprocessors.
- Privacy: personal data handling, data locations, and regulatory commitments like GDPR.
- Certifications and reports: SOC 2, ISO 27001, penetration tests.
How to answer a questionnaire
- TriageCheck the due date, the format, and whether a SOC 2 report or trust center can answer most of it.
- Match past answersFind questions you have answered before and reuse confirmed answers.
- Answer from evidenceTie each answer to a policy, report, or system result so it can be defended.
- Route the restSend new or technical questions to the right owner with a deadline.
- ReviewHave one person check tone, consistency, and anything that commits you to something new.
- Return and saveSend it back in the requester's format and add new answers to your library.
Answering efficiently
Most questions repeat across customers. A library of confirmed answers, each tied to evidence and dated, lets teams reuse them with confidence and focus on the questions that are new.
Keep answers short and specific. "Yes. MFA is enforced for all workforce users through Okta, and our SOC 2 Type II report (section 4, CC6.1) tests it" is more convincing than a paragraph of general language. Where the true answer is "partially," say so and describe the compensating control.
Mistakes to avoid
- Answering yes to a control you do not run. It can become a contract commitment.
- Copying an old answer after the underlying control changed.
- Different answers to the same question for different customers.
- Attaching the whole policy library when one section answers the question.
- Letting sales promise a turnaround the security team has not agreed to.
If you send questionnaires
On the buying side, size the questionnaire to the vendor's risk tier, accept a SOC 2 report or ISO certificate in place of questions it already covers, and read answers against evidence. See third-party risk management and vendor tiering.
Sample questions and strong answers
| Question | A strong answer |
|---|---|
| Do you enforce MFA for all users? | Yes. MFA is enforced for all workforce accounts through our identity provider. Tested in our SOC 2 Type II report under CC6.1. |
| Is customer data encrypted at rest? | Yes. All production databases and storage use AES-256 encryption managed by our cloud provider's key management service. |
| Do you perform penetration testing? | Yes. An independent firm tests our application and infrastructure every year. A summary letter is available under NDA. |
| How quickly do you notify customers of a breach? | Within 72 hours of confirming an incident that affects customer data, as set out in our data processing agreement. |
| Do you use subprocessors? | Yes. Our current list of subprocessors and their locations is published on our trust page. |
Building an answer library
- CollectGather the last 10 to 20 questionnaires you completed.
- DeduplicateGroup the questions that ask the same thing in different words.
- ConfirmHave each owner confirm the best current answer and link its evidence.
- DateGive every answer a review date, and review it when the underlying control changes.
- ReuseStart every new questionnaire by matching against the library.
Who should own questionnaires
In most companies the security or GRC team owns the answers and the library, and sales engineering or a deal desk manages timelines with the customer. Legal reviews anything that becomes a contract commitment. Clear ownership keeps answers consistent and stops the same question being answered three different ways.
How TruOps helps
Upload the SIG, CAIQ, or custom questionnaire a customer sent. TruOps answers most of it from your evidence and past answers, cites the source behind each answer with a confidence score, and routes the rest to the right owner. A person approves every answer, and the finished questionnaire exports in the requester's format.
What to look for
If inbound questionnaires slow down sales, you need an answer library tied to evidence. Check for answer dates and a clear rule against made-up answers.
Questions
What is the difference between SIG and CAIQ?
SIG, from Shared Assessments, covers third-party risk broadly. CAIQ, from the Cloud Security Alliance, focuses on cloud security and maps to the Cloud Controls Matrix.
How long does it take to answer a security questionnaire?
It ranges from an hour to several weeks, depending on length, how many questions are new, and whether answers can be reused from a library.
Can a SOC 2 report replace a questionnaire?
Often in part. Many buyers accept a SOC 2 Type II report for the questions it covers and send a shorter questionnaire for the rest.
What is a trust center?
A public or gated web page where a vendor shares its security posture, certifications, and documents like a SOC 2 report, so customers can find answers without sending a questionnaire.
Related
Answer customer security reviews from your evidence, in whatever format they arrive.
→Use casesAnswering customer questionnairesAnswer SIG, CAIQ, and custom questionnaires from your evidence.
→Use casesVendor risk assessmentsTier, assess, and check vendors without getting buried in questionnaires.
→LearnThird-party risk managementTPRM: managing the risks vendors bring.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.