Glossary
Short, sourced definitions of the terms that come up in security reviews: questionnaires, audits, contracts and evidence.
- Evidence vs attestation in security reviewsDraftIn a security review, evidence is anything that shows a control exists; an attestation is an independent party's formal statement about it. How they differ and why it matters.Updated
- What is a DPA (data processing agreement)?DraftA data processing agreement (DPA) is the contract between a company and a vendor that processes personal data for it. What GDPR requires and why it shows up in security reviews.Updated
- What is a subprocessor?DraftA subprocessor is a third party your vendor uses to process your personal data, such as its cloud host or AI provider. What GDPR requires and why questionnaires ask for the list.Updated
- What is a trust center?DraftA trust center is a public or gated web page where a vendor shares its security documents, certifications and policies, so buyers can self-serve instead of sending a questionnaire.Updated
- What is a vendor risk assessment?DraftA vendor risk assessment is how a company checks a supplier's security and other risks before buying. How it works, where questionnaires fit, and what vendors should expect.Updated
- What is ISO 27001?DraftISO/IEC 27001 is the international standard for an information security management system (ISMS). What certification means and how it differs from SOC 2.Updated
- What is SOC 2?DraftSOC 2 is an audit report from an independent CPA firm on a service company's security controls. Type 1 vs Type 2, the five categories, and what it means for questionnaires.Updated
- What is the CAIQ?DraftThe CAIQ is the Cloud Security Alliance's yes/no security questionnaire for cloud and SaaS providers. What it covers, its versions, and where you'll meet it.Updated
- What is the HECVAT?DraftThe HECVAT is the EDUCAUSE security questionnaire US colleges and universities send to software vendors. What it is and what changed in version 4.Updated
- What is the SIG questionnaire?DraftThe SIG (Standardized Information Gathering) questionnaire is Shared Assessments' licensed vendor risk questionnaire, in Lite and Core versions. What it is and who sends it.Updated
Send one questionnaire. See the proof.
First questionnaire free. Same-day turnaround. Tell us where to send it back and we'll reply with next steps.
Send your first questionnaire free
Takes about 15 seconds. Or email hello@citesheet.com.
Need an NDA first? Ask, and we'll sign before you send anything.