Security Questionnaires

Vendor Security Questionnaire guide, examples, and tips

Definition

A vendor security questionnaire is a structured set of questions a customer sends a supplier to assess how it protects data and systems before (and during) a business relationship. It covers policies, technical controls, and compliance evidence, and it is a core step in the buyer's third-party risk management process.

If you sell software or services to larger organizations, security questionnaires are part of every deal. This guide explains the common formats, what they ask, and how to answer them accurately without losing a week to each one.

Updated September 202610-minute readFor vendors and buyers

Why buyers send vendor security questionnaires

When a company shares data with a supplier, or lets a supplier's software into its environment, it inherits some of that supplier's risk. Third-party risk management (TPRM) programs exist to measure that risk before the contract is signed and to keep measuring it for as long as the relationship lasts. Regulators in financial services, healthcare, and the public sector expect it, and so do auditors reviewing the buyer's own SOC 2 or ISO 27001 program.

A questionnaire is the scalable first step. It lets a buyer collect comparable answers from dozens or hundreds of vendors, tier them by risk, and reserve deeper reviews (evidence requests, calls with your security team, on-site audits) for the vendors that matter most. For the vendor, it usually lands in the middle of a sales cycle, often attached to an RFP, and it can block a signature until it is done.

Expect them at three moments: during procurement of a new vendor, at annual or periodic reassessment, and after a significant change such as a breach, an acquisition, or a new product that processes more sensitive data.

Common vendor security questionnaire formats

There is no single standard. Most questionnaires you receive will be one of the formats below, or a custom spreadsheet that borrows heavily from them.

SIG (Standardized Information Gathering)

Published by Shared Assessments and updated annually. Broad third-party risk coverage across many risk domains, widely used by banks and other regulated buyers. Comes in a lighter and a fuller scope. See our SIG questionnaire guide.

CAIQ (Consensus Assessments Initiative Questionnaire)

From the Cloud Security Alliance, built on the Cloud Controls Matrix (CCM) and aimed at cloud and SaaS providers. Answers are yes/no/not applicable with explanations, and many providers publish theirs in the CSA STAR registry. See our CAIQ guide.

HECVAT (Higher Education Community Vendor Assessment Toolkit)

Maintained by EDUCAUSE for colleges and universities. HECVAT 4 merged the earlier Full, Lite, and On-Premise versions into a single workbook and added questions on AI and privacy. If you sell to higher education, expect it.

VSA questionnaires and VSAQ

The Vendor Security Alliance, a consortium of technology companies, publishes free questionnaires (a Full and a Core version). "VSAQ" is also the name of an open-source questionnaire framework Google released in 2016, so check which one a buyer means.

Custom spreadsheets and portal questionnaires

Many buyers send their own Excel workbook, or ask you to answer inside a third-party risk platform such as OneTrust, Whistic, or a similar portal. The questions are familiar; the friction is the format, character limits, and copy-pasting between systems.

What a vendor security questionnaire covers

Whatever the format, the same domains come up again and again. If you maintain one approved answer set per domain, you can answer most questionnaires from it.

Governance, risk, and compliance

Policies, ownership, risk assessments, security awareness training, and third-party attestations.

Access control and identity

MFA, SSO, least privilege, joiner-mover-leaver processes, privileged access, and access reviews.

Data protection and encryption

Encryption in transit and at rest, key management, data classification, retention, and deletion.

Infrastructure and operations

Network security, hardening, vulnerability and patch management, logging, and monitoring.

Incident response

Detection, escalation, customer notification commitments, and post-incident reviews.

Business continuity and disaster recovery

Backups, recovery time and recovery point objectives, and how often plans are tested.

Secure software development

Secure SDLC, code review, dependency management, testing, and change management.

Vendor and subprocessor management

Which fourth parties touch customer data and how you assess them in turn.

Privacy

GDPR and other privacy laws, data processing agreements, data subject requests, and data residency.

AI usage

Whether AI features process customer data, whether data trains models, and what human oversight exists. A fast-growing section in recent questionnaires.

Example vendor security questionnaire questions

These are typical questions, paraphrased, that appear in some form in most questionnaires. Use them as a template to check whether your answer library is ready.

Governance and policy

Do you have a documented information security policy approved by management, and how often is it reviewed?
Who is accountable for information security in your organization?
Do you hold any independent attestations or certifications (for example SOC 2, ISO 27001)?

Access control

Is multi-factor authentication enforced for workforce access to production systems and admin consoles?
How are user accounts provisioned, reviewed, and removed when someone changes role or leaves?
Do you support single sign-on (SAML/OIDC) for customer users?

Data protection

Is customer data encrypted in transit and at rest?
Where is customer data stored and processed, and can the customer choose a region?
How is customer data deleted at the end of the contract?

Incident response and resilience

Do you have a documented incident response plan, and when was it last tested?
Within what timeframe will you notify customers of a security incident affecting their data?
Do you have business continuity and disaster recovery plans with defined recovery objectives?

Secure development, subprocessors, and AI

Do you perform code review, dependency scanning, and periodic penetration testing?
Which subprocessors handle customer data, and how do you assess them?
Do you use AI or machine learning on customer data, and is customer data used to train models?

How to answer a vendor security questionnaire well

Reviewers read hundreds of these. Clear, consistent, evidence-backed answers move you through review; vague or contradictory ones trigger follow-up calls and delay the deal.

Answer the question that was asked. Lead with yes, no, partial, or not applicable, then one or two sentences of specifics. Avoid pasting whole policy sections.
Back answers with evidence. Reference the policy, report, or control that supports each claim, and keep it available if the reviewer asks.
Stay consistent with your audit reports. If you have a SOC 2 report or ISO 27001 certificate, your answers must match what the auditor described. Buyers compare them.
Use "partial" honestly. Describe what is in place, the compensating controls, and any dated remediation plan. An honest gap is a conversation; an overstated "yes" can become a contractual problem.
Assign owners and a review cadence. Each domain should have an owner (security, IT, engineering, legal) who approves the standard answer and reviews it at least when policies, infrastructure, or subprocessors change.
Scope carefully. Answer for the product and data the buyer is actually purchasing, and say so. "Not applicable" needs a one-line reason.

How to complete vendor security questionnaires faster

1. Build an approved answer library

Collect every past questionnaire, your policies, and your audit reports in one place. Turn recurring questions into approved standard answers with an owner and a last-reviewed date. This single step removes most of the effort from the next questionnaire.

2. Publish what you can up front

A public security page or trust center with your certifications, subprocessor list, and policy summaries answers many questions before they are asked, and a completed standard questionnaire (such as a CAIQ) can often be sent instead of starting a new one.

3. Draft with AI, review with humans

Tools built for this, such as RFP.ai for security questionnaires, import the spreadsheet, draft each answer from your approved documents with a source citation and a confidence score, and route low-confidence answers to the right reviewer. The browser extension helps with portal-based questionnaires. Our security questionnaire automation guide walks through the workflow step by step, and SaaS teams can see the DDQ automation workflow.

4. Feed approved answers back into the library

Every questionnaire you finish should make the next one easier. Promote reviewed answers to the library and retire outdated ones so drafts stay current.

Common pitfalls to avoid

Copying an old answer that no longer matches your current infrastructure or subprocessors.
Giving different answers to the same question in different questionnaires.
Answering 'yes' to controls that exist on paper but are not operating.
Letting generic AI tools answer from general knowledge instead of your own documentation.
Sending sensitive evidence (full penetration test reports, network diagrams) without an NDA or a secure sharing channel.
Missing the buyer's deadline because nobody owned the questionnaire.

Buyers evaluating RFP.ai itself can review our security page and pricing.

Frequently Asked Questions

Buyers are accountable for the data they share with suppliers. Regulators, auditors, and their own security teams expect them to assess third parties before signing and to reassess them periodically. A questionnaire is the cheapest way to collect consistent evidence from many vendors and decide which ones need a deeper review.

The SIG (Standardized Information Gathering questionnaire) from Shared Assessments is a broad third-party risk questionnaire used heavily in financial services. The CAIQ (Consensus Assessments Initiative Questionnaire) from the Cloud Security Alliance is focused on cloud providers and maps to the Cloud Controls Matrix. Custom questionnaires are written by the buyer's own security team and vary widely, though most borrow structure from these standards.

It depends on the length and on how prepared you are. A short questionnaire can take an hour; a full SIG or HECVAT can take days when answers have to be tracked down across engineering, legal, and IT. Teams with a maintained answer library and current evidence (SOC 2 report, ISO 27001 certificate, policies) finish much faster than teams starting from scratch.

Sometimes. Many buyers accept a SOC 2 Type II report or ISO 27001 certificate in place of part of a questionnaire, and some standardized formats let you reference them. Still, most buyers want the questionnaire itself completed, because they score answers in their own risk tool. Offer the report, then answer the questions consistently with it.

Yes. An honest 'no' or 'partial' with a short explanation of compensating controls and any planned remediation is far better than an overstated 'yes'. Questionnaire answers are often referenced in contracts, and a misstatement found later is a bigger problem than a gap disclosed up front.

AI can draft answers quickly when it works from your own approved security documentation and past answers rather than general knowledge. The safe pattern is: draft from approved sources, show the citation for each answer, flag low-confidence answers, and have a security owner review before anything is sent.

Answer your next security questionnaire from your own sources

RFP.ai imports the questionnaire, drafts each answer from your approved security documentation with a citation and a confidence score, and routes weak answers to a reviewer before you export.

Try RFP.ai free Free question extractor

Security questionnaire software →Free question extractor →Pricing →

Related Resources

Standards

SIG Questionnaire Guide

What the Shared Assessments SIG covers and how to answer it fast