Draft
Vendor security questionnaires: what they are and how to answer them fast
By The Citesheet team · Published
Short answer
A vendor security questionnaire is a list of questions a customer sends before buying, to check how you protect their data. Common formats are the CAIQ, the SIG, the HECVAT and custom Excel files. The fast way to answer is from your own written policies, with proof for each answer and an honest No where you have none.
A vendor security questionnaire is a list of questions a customer sends you before they buy. They want to know how you protect their data: who can access it, how it's encrypted, what happens in a breach. It usually arrives as an Excel file with a few dozen to a few hundred rows, and a deadline.
The common formats
| Format | Who publishes it | Typical sender | Notes |
|---|---|---|---|
| CAIQ | Cloud Security Alliance | Cloud and SaaS buyers | v4 has 261 questions, based on the CSA Cloud Controls Matrix |
| SIG | Shared Assessments | Banks, insurers, larger enterprises | Licensed, not free to download; provided in Microsoft Excel |
| HECVAT | EDUCAUSE | US colleges and universities | HECVAT 4 is free for institutions and their vendors |
| Custom Excel | The buyer's own security team | Anyone | Often a mix of the above, with their own wording |
Many buyers use their own questionnaire. Even then, the questions tend to cover the same ground: access control, encryption, logging, incident response, backups, vendor management, HR security and privacy.
More on each format: SIG Lite vs SIG Core, HECVAT 4 for vendors, and what the CAIQ is.
How to answer one fast (without making things up)
1. Gather your documents first. Security policy, access control, incident response, data retention, business continuity, any audit or pen test reports. Most answers live in these. If a policy is missing, that's your first gap.
2. Answer from evidence, not memory. For each question, find the sentence in your policy that answers it. If you can't find one, don't guess. Write No, Partially or "Not applicable", and explain.
3. Keep the buyer's file intact. Don't retype the questions into a new sheet, and don't break the dropdowns. Fill in their file, in their columns.
4. Reuse carefully. Your last questionnaire is a good starting point. But check that each answer is still true, and that the new question asks the same thing.
5. Review the sensitive rows yourself. Breach history, legal commitments, subprocessors, data location. These go into contracts.
6. Send it with an offer. "Happy to walk through any answer on a call." It shortens the back-and-forth.
No SOC 2 report yet? Read how to answer a security questionnaire without SOC 2.
How Citesheet helps
Citesheet fills Excel security questionnaires, such as the CAIQ, from your own policies. Each answer has a word-for-word quote from your document, which code checks before the answer ships. Where there's no proof, the row says "No proof found", and you get a list of gaps. Your file comes back with the same questions, layout and dropdowns.
We measured it on a 261-question CAIQ filled from GitLab's public policies: 158 of 163 filled answers matched GitLab's own answers. See the benchmark for the method.
Our tested format is the CAIQ. If you have a different Excel questionnaire, send it and we'll tell you how it does. Your first questionnaire is free, then pilot pricing.
Sources
- Cloud Security Alliance: What is CAIQ? (Sept 1, 2021) (accessed )
- Shared Assessments: What is the SIG? (accessed )
- Shared Assessments: SIG FAQ (accessed )
- EDUCAUSE: Higher Education Community Vendor Assessment Toolkit (HECVAT) (accessed )