Questionnaire standards

Which security questionnaire are you actually looking at?

Most vendor assessments are one of four workbooks wearing a customer's logo. Here is what each one is, how it is structured, and what it takes to answer it properly.

CAIQ v4

The Cloud Security Alliance's questionnaire, aligned to the Cloud Controls Matrix. The default ask for cloud vendors, and the one most often accepted in place of a customer's own form.

Read the breakdown

SIG & SIG Lite

Shared Assessments' questionnaire, updated annually and used heavily in financial services. SIG Lite is the shortened version; the full SIG runs into four figures.

Read the breakdown

HECVAT

The higher-education toolkit maintained through EDUCAUSE. If a university or college is buying, this is almost certainly the form you will receive.

Read the breakdown

VSA

The Vendor Security Alliance questionnaire, built by security teams at companies that buy a lot of software. Shorter and more opinionated than the alternatives.

Read the breakdown

Not one of these? We also publish free tools for adjacent work — the NIS2 readiness check, the policy generator. Custom spreadsheets from a customer's own security team work the same way: the question column is detected automatically, and answers are written back into the file you received.