What is a security questionnaire?

Definition

A security questionnaire is a structured set of questions a prospective or current customer sends to a vendor to evaluate the vendor’s information security practices as part of third-party due diligence.

Background

When a company buys software that will touch its data, its security team vets the vendor, and a questionnaire is the common mechanism. Some are standardized (for example the Shared Assessments SIG, or the Cloud Security Alliance CAIQ), while many are the buyer’s own spreadsheet. Questions span access control, encryption, network security, incident response, business continuity, personnel security, and which compliance reports (such as SOC 2 or ISO 27001) the vendor holds. Shared Assessments publishes the SIG (Standardized Information Gathering questionnaire) in a full version and a shorter SIG Lite. The CAIQ (Consensus Assessments Initiative Questionnaire) is based on the Cloud Security Alliance’s Cloud Controls Matrix, and cloud providers can publish a completed CAIQ in the CSA STAR registry. Colleges and universities often send the HECVAT instead.

Why it matters

For vendors, questionnaires are a recurring cost of doing business that can slow deals; consistent, accurate answers backed by evidence speed up security review. For buyers, they are a core vendor-risk tool. Either way, answers must be truthful, an inaccurate questionnaire response is a serious trust and liability problem. A buyer reads the answers to find security gaps that would affect its own risk: where customer data is stored, who can reach it, and what happens in an incident. Some buyers attach the completed questionnaire to the contract or refer to it in a security addendum, so an answer can turn into a commitment.

Step by step

1. Maintain a reviewed library of standard answers grounded in your real controls and evidence.
2. Map incoming questions to your existing answers rather than rewriting each time.
3. Attach or reference evidence (like a SOC 2 report or trust center) where possible.
4. Have a knowledgeable owner review answers before they go out.
5. Name a subject matter expert for each area (infrastructure, HR, legal, incident response) to confirm answers the library does not cover.
6. Keep the answer library current as your controls change.
7. When a question exposes a real gap, answer it truthfully and log the gap for remediation. Do not promise a fix you have not scheduled.

Examples

• A buyer sends a 200-row spreadsheet covering encryption, access reviews, and incident response before signing.
• A vendor answers most questions by pointing to its trust center and SOC 2 report, and only writes bespoke answers for the rest.
• A potential vendor receives a SIG Lite from a bank and answers the incident response planning questions by citing its documented plan and the date of its last tabletop exercise.
• On a paid Keel plan, a team uploads the spreadsheet it was sent. Keel drafts answers from the team’s own controls and policies, marks the ones it cannot support as needing review, and writes the answers it could verify back into the .xlsx file.

Common mistakes

• Answering from memory instead of from documented, current controls and evidence.
• Overstating capabilities to win a deal, which creates real liability if a claim is untrue.
• Re-answering the same questions from scratch every time instead of reusing a maintained library.
• Answering yes for a control that only covers part of your environment. State the scope in the answer.

FAQ