To answer a customer security questionnaire, answer the three questions behind every row once, from a library keyed to your controls. Do you know what you have? Can you show a control is running? What happens when something goes wrong? With a library, a CAIQ of around 260 questions takes 2 to 4 days instead of 2 to 3 weeks.
This guide covers the formats, the three questions, what to ask back, consistency, the answer library, what ISO 27001 pre-answers, and what the questionnaire does not test.
| Format | Turns up when you sell to | Questions | First time | With an answer library |
|---|---|---|---|---|
| VSA, Vendor Security Alliance | Technology companies | 100 to 140 | 1 to 2 weeks | 1 to 2 days |
| CAIQ, Cloud Security Alliance | Cloud-centric buyers | around 260 | 2 to 3 weeks | 2 to 4 days |
| SIG Core, Shared Assessments | Financial services | 800 plus | 4 to 8 weeks | 1 to 3 weeks |
Which security questionnaire will you receive?
Most questionnaires are one of those three standard formats, or somebody’s edited copy of one.
The range within a row is larger than the range between rows. A SIG with a library behind it is faster than a CAIQ without one. The format you receive matters far less than whether you have answered anything before.
The SIG is the long one because it reaches well beyond security, into financial condition, enterprise risk and environmental factors.
What is a security questionnaire really asking?
The spreadsheet is not really a test of your security. It is a test of whether you have already written down what you do. Strip the formats away and three questions remain, and every row is a rephrasing of one of them.
1. Do you know what you have?
Assets, data, suppliers, who has access to what. Perhaps a third of any questionnaire is this question in different clothes.
2. Can you show that a control is running, not just written?
Not “do you have a password policy” but “when did you last review access, and can you show me”. This is the half that catches companies who have documents but no records, the distinction set out in evidence that assembles itself.
3. What happens when something goes wrong?
Detection, response, notification to them specifically, recovery, and how fast.
A company that can answer those three properly can answer any questionnaire. A company that cannot will answer each one from scratch, differently, forever.
What should you ask the customer before you start?
Two questions, and they save more time than any tooling.
- “Which sections apply given what you are buying?” Most questionnaires are sent unedited. If you are supplying a single SaaS module, the physical security of your manufacturing sites is not in scope, and the reviewer will usually agree if asked. This is a normal conversation, not pushback.
- “Would our ISO 27001 certificate and Statement of Applicability satisfy part of this?” Frequently yes, particularly for the governance sections. Ask before spending two weeks retyping the same content in their format.
Why do inconsistent answers lose deals?
The failure that costs deals is not a bad answer. It is three different answers.
Picture a 40-person company. The questionnaire arrives, gets split by section, and lands on three people. The engineer answers the technical rows from what is actually deployed. Someone in operations answers the process rows from what the policy says. A founder answers the governance rows optimistically, because the deal matters.
The result contradicts itself. Row 40 says access reviews are quarterly. Row 210 says annually. Row 15 says you have a documented incident response plan. Row 300 says incident response is handled ad hoc by the CTO.
Reviewers notice, because comparing answers is their job. Inconsistency reads as disorganisation or evasion. Both are worse than a plain “we do not do this yet, here is the compensating control and the date we will”.
Being honest about a gap almost never loses a deal at this size. Being caught contradicting yourself sometimes does.
How do you build a security questionnaire answer library?
The practical fix is unglamorous, and it works.
- Key answers to controls, not to questionnaires. The unit is “how we do access review”, not “row 212 of the CAIQ from that customer in March”. When the next format arrives, you map its rows onto your controls rather than starting again.
- Give every answer a date and an owner. A library that nobody maintains is worse than none, because it confidently reproduces a stale answer. The date tells you which entries to check before sending.
- Write the gaps down as gaps, with a plan. The rows where the honest answer is no are worth pre-writing carefully, because you will be asked them again. “Not currently, mitigated by X, planned for Q2” is a reusable answer. Silence is not.
- Keep the scope boundary in the library too. A large share of questionnaire disputes are really scope disputes: the customer asks about a system that is not in the environment serving them. Saying clearly what is in and out is the same discipline as scope and the Statement of Applicability.
This is also the point of holding the control set, the evidence and the answers in the same place. Not because a tool beats a spreadsheet in principle, but because an answer that lives next to its control gets updated when the control changes. An answer in last year’s spreadsheet does not.
How much of a security questionnaire does ISO 27001 answer?
A large share of every format, but never all of it. This is the argument for ISO 27001 certification that nobody makes properly, because it is commercial rather than regulatory.
| Format | Covered by SOC 2 | Covered by ISO 27001 |
|---|---|---|
| VSA | 70 to 80% | 75 to 85% |
| CAIQ | 60 to 70% | 75 to 80% |
| SIG | 40 to 50% | 50 to 65% |
ISO 27001 outperforms SOC 2 on all three. Even so, it tops out around 85%, and on a SIG it covers barely half. There is no certificate that makes questionnaires go away.
What the certificate really does is different from the coverage number. It gives you a control set with owners, statuses and evidence attached, so the remaining questions have somewhere to be answered from. Without that, the coverage percentage is theoretical. Getting there is covered in ISO 27001 for a company without a security team, and the honest budget in what ISO 27001 actually costs an SME.
What does a security questionnaire not test?
It tests documentation. It asks whether a control exists and whether you can describe it. Every question in every one of those formats can be answered truthfully by a company where logging is configured and never queried, where the vulnerability scanner runs monthly into a report nobody reads, and where no restore has ever been timed. All of those are yes answers.
The test changes on the follow-up call. A security reviewer who is paying attention asks second questions: how long has your longest-open critical finding been open, when did you last restore from backup and how long did it take, what would tell you an account had been compromised. Those have numbers as answers, and the numbers are either there or they are not.
So the answer library gets you through the spreadsheet, and it is worth building. It does not get you through the call. That takes detection and exposure management actually running, producing findings with owners and deadlines, which is the same gap described in what a certificate leaves open. An independent security audit is the quickest way to find out which of your questionnaire answers would survive the follow-up question.
Security questionnaire checklist
- Ask which sections apply, and whether your certificate and Statement of Applicability cover part of it.
- Answer from one library keyed to your controls.
- Check the date and owner on every answer before sending.
- Read the whole response for rows that contradict each other.
- Where the honest answer is no, give the compensating control and a date.
- State what is in and out of scope for the service they are buying.
- Have numbers ready for the follow-up call: longest-open critical finding, last timed restore.
Frequently asked questions
How long does it take to answer a security questionnaire?
It depends more on whether you have answered one before than on the format. A CAIQ of around 260 questions takes 2 to 3 weeks the first time and 2 to 4 days with an answer library. A SIG Core of 800 plus questions takes 4 to 8 weeks the first time and 1 to 3 weeks with a library.
What is the difference between VSA, CAIQ and SIG questionnaires?
VSA, from the Vendor Security Alliance, has 100 to 140 questions and turns up when you sell to technology companies. CAIQ, from the Cloud Security Alliance, has around 260 and turns up when the buyer is cloud-centric. SIG Core, from Shared Assessments, runs to 800 plus, turns up in financial services and reaches beyond security into financial condition, enterprise risk and environmental factors.
Does ISO 27001 help with security questionnaires?
Yes. Holding ISO 27001 pre-answers about 75 to 85% of a VSA, 75 to 80% of a CAIQ and 50 to 65% of a SIG, more than SOC 2 on all three. No certificate makes questionnaires go away, but it gives you a control set with owners and evidence to answer the rest from.
What should you do if the honest answer to a security question is no?
Say so, with the compensating control and the date you will close the gap. Being honest about a gap almost never loses a deal for an SME. Contradicting yourself between rows sometimes does.
Can you skip sections of a security questionnaire?
Often, if you ask. Most questionnaires are sent unedited, so ask which sections apply given what the customer is buying. If you supply a single SaaS module, the physical security of manufacturing sites is not in scope, and the reviewer will usually agree.
