SaaS Security Questionnaire: Questions, Checklist, Answers

The deal is moving. Then the buyer's security team emails a spreadsheet that can run to hundreds of rows, and the clock starts. If you sell SaaS to mid-market and enterprise buyers, this file shows up in many deals.

Most guides on this topic are written for the buyer who sends it. This one is for the SaaS vendor who answers it: presales, solutions engineers and the security or GRC owner who signs off.

A SaaS security questionnaire is a set of questions a buyer sends a software-as-a-service vendor before signing. It asks how the vendor protects customer data in a shared cloud: tenant isolation, access and SSO, encryption, subprocessors, data location and deletion, incident response and AI use. The buyer scores the answers and evidence to approve or reject the vendor.

The pressure is real. Third parties were involved in 48% of breaches in Verizon's 2026 Data Breach Investigations Report, up from 30% a year earlier. A SaaS vendor holds customer data by design, so buyers look hard.

In this guide:

• What is a SaaS security questionnaire?
• How is it different from a generic vendor questionnaire?
• Why do buyers send them?
• What does it ask?
• Which standard questionnaires will you see?
• How do buyers score it?
• SaaS security checklist: what to have ready
• How do you answer one?
• What about questions that don't apply?
• Can AI answer it?

What is a SaaS security questionnaire?

A SaaS security questionnaire is the buyer's check on how you run security for a product that lives in the cloud and holds their data. Buyers use a few names for it. You will see "software security questionnaire," "SaaS security assessment questionnaire" or simply "SaaS assessment questionnaire." The work is the same.

The buyer's security or buying team sends it. On your side, presales often runs it. Security, engineering and legal supply the answers.

It tends to arrive late, after the technical win and before the contract. The format varies:

• A spreadsheet the buyer built.
• A Word file with open questions.
• A vendor risk portal.
• A standard questionnaire such as the CAIQ questionnaire, which has 283 questions in v4.1.

For the full generic question bank, see our guide to the vendor security assessment questionnaire. This post covers what changes when the product is SaaS.

How is a SaaS security questionnaire different from a generic vendor questionnaire?

Three things change when you deliver software as a service.

Shared responsibility. You run on someone else's cloud. AWS calls its part "security of the cloud" in its shared responsibility model. You get physical and site controls from your host.

The customer always keeps its own users, accounts and data.

Multi-tenancy. Many customers share your platform. AWS's SaaS guidance calls tenant isolation "one of the foundational topics that every SaaS provider must address."

Subprocessors. Your own suppliers process the buyer's data. Under GDPR, the buyer gets a say in that chain.

Microsoft's shared responsibility page shows the SaaS split. The SaaS provider runs network controls, the operating system and hosts. Applications and client devices are shared. Data, settings, identities and users stay with the customer.

Add your cloud host underneath, and the split for your answers looks like this. The table is our summary, adapted from Microsoft and AWS.

Practitioners still get on-prem questions as cloud vendors. One security writer described "spending hours fielding questions about touring your data center." The table above is how you answer those quickly. More on that below.

For the wider category, see our guide to the information security questionnaire.

Why do buyers send SaaS security questionnaires?

The 48% third-party figure is the headline. Frameworks push the same way. NIST's Cybersecurity Framework 2.0 added a Govern function with a supply chain category. It says suppliers should be "known and prioritized by criticality."

AI added a new layer. SecurityPal, a questionnaire services vendor, reports that buyers increasingly ask whether customer data trains AI models.

The cost lands on the vendor too. Vanta's State of Trust 2025 survey found teams spend 9 working weeks a year on vendor security reviews, up from 7. That is a vendor survey, so treat it as a signal, not a benchmark.

So the buyer uses the file to show it checked you. Read it as a request for proof, not a verdict.

What does a SaaS security questionnaire ask?

The usual questions still show up. The ones below are the SaaS ones.

Tenant isolation and architecture

Buyers want to know how you split tenants. AWS's SaaS Lens names three: silo (dedicated resources per tenant), pool (shared resources) and bridge (a mix). Say which one you run, and for which layers.

Then explain how you stop one tenant from reaching another. AWS's guidance includes "Bind user identity to tenant identity." The CSA Cloud Controls Matrix also expects access to be segmented between tenants.

Hosting and shared responsibility

Name your cloud host and the regions you use. Then say which controls come from the host and which you run. The CAIQ has a column for exactly this: who owns each control, the provider, the customer, a third party, or shared.

Identity: SSO, SCIM and MFA

NSA and CISA call SSO "a table stakes feature for organizations of all sizes." CISA's Secure by Design pledge asks vendors to measurably increase MFA use. One example it gives is standards-based SSO in the baseline product.

Buyers also ask about deprovisioning. SCIM can remove a user automatically. Microsoft notes that SAML just-in-time provisioning "can't delete or deactivate the users in the application." If you support only one, say so.

For your own staff, the CSA CCM expects MFA for at least privileged and sensitive data access.

Data protection, location and deletion

Expect questions on encryption, where data and backups live, and what happens when the contract ends. The CCM asks providers to "Specify and document the physical locations of data, including where processing and back up take place."

GDPR Article 28 requires the processor to delete or return personal data at the end of the service, at the customer's choice. Buyers with EU data may ask about the EU-U.S. Data Privacy Framework, which the EU adopted in July 2023.

Subprocessors and privacy

Under GDPR Article 28, a processor needs the controller's prior specific or general written authorisation to use another processor. Under general authorisation, it must tell the controller about planned changes so it can object. Subprocessors carry the same data protection obligations, and you stay liable for them.

Keep your subprocessor list current. Have a set way to tell customers about changes. If you process personal data in a public cloud, ISO/IEC 27018:2025 is the guideline buyers may name.

Application security and pen testing

Expect questions on how you build, test and patch the product. Keep product controls and company controls apart. "Do you encrypt data?" can mean your laptops or your product.

Availability, backup and incident response

Buyers ask about uptime, backups, how fast you recover and how fast you tell them about a breach. If your SOC 2 report covers Availability, point to it.

AI features and customer data

AI questions are now common. One engineering blog listed two that keep coming up: "Is customer data used for training? If yes, can it be excluded?" and whether inference can stay in a region such as the EU.

Standards are catching up. The CSA's AI-CAIQ has 320 questions, and ISO/IEC 42001 sets requirements for an AI management system. If your product uses AI, write these answers before a buyer asks.

Which standard questionnaires do SaaS vendors get?

Some buyers send a standard questionnaire. Others send a custom sheet, often built from one.

Sources: CSA, Mitratech on SIG 2026, the Vendor Security Alliance and EDUCAUSE.

The answers overlap. Across SiftHub customers, 68% of security questionnaire questions are near-duplicates of ones answered in the last 90 days. One master answer set covers a large share of each format. Our guides to the SIG questionnaire and the VSA questionnaire go deeper.

How do buyers score a SaaS risk assessment questionnaire?

A SaaS risk assessment questionnaire feeds a risk rating. Buyers first group vendors by how much data they touch and how critical they are. That tier sets how deep the review goes. SIG's Lite, Core and Detail presets let buyers scale the questionnaire to match.

A few things help your rating:

• Evidence attached to the answers that need it.
• Specific answers that name the tool, the frequency and the owner.
• A clear split of who owns each control under shared responsibility.
• An honest "No" paired with a compensating control.

Vague answers invite follow-up rounds, and each round adds time.

What is included in a SaaS security assessment?

A SaaS security assessment usually has three parts. There is the questionnaire, a review of your proof such as a SOC 2 report, and sometimes a technical check.

For a SaaS vendor security assessment, the questionnaire is often a large share of the work on your side.

SaaS security checklist: what should a vendor have ready before the questionnaire lands?

Most SaaS security checklists online are for companies securing the apps they buy. This SaaS security assessment checklist is the other side: what a SaaS vendor should have ready before the next questionnaire arrives.

1. A SOC 2 Type II report under the current Trust Services Criteria (2017 criteria with revised points of focus, 2022).
2. An ISO/IEC 27001:2022 certificate. 2013 certificates expired on October 31, 2025.
3. Optional cloud add-ons: ISO/IEC 27017:2026 for cloud security controls and ISO/IEC 27018:2025 for PII in public clouds.
4. A completed CAIQ v4.1, or a CSA STAR Level 1 listing.
5. A tenancy and architecture diagram.
6. A shared responsibility statement.
7. A subprocessor list with your change-notice process.
8. A DPA covering deletion, return and audit rights.
9. A data location map for production and backups.
10. An SSO, SCIM and MFA support summary.
11. A pen test summary letter and an incident response summary.
12. An AI data use statement.

SOC 2 reports are usually shared under an NDA or through a trust center. For low-risk buyers, a trust center with these documents can be enough on its own.

How do you answer a SaaS security questionnaire?

Some teams treat each one as a fire drill. A steady process works better.

1. Confirm scope, product and deadline

Confirm which product the answers cover and which data you will touch. Check which standard the file follows, whether it is a file or a portal, and the due date.

2. Send your evidence pack first

Send your SOC 2 report, ISO certificate and completed CAIQ before you start. It will not always stop the questionnaire. As one Hacker News commenter put it, "Even with a SOC2, many companies will simply issue a questionnaire out of policy." It still makes many answers faster.

3. Start from a master answer set

Repeated questions are the norm. One Indie Hackers post described "answering the same questions for every enterprise prospect, just slightly reworded." A reviewed answer library fixes that. See how to reuse security questionnaire responses.

4. Route each section to an owner

Security owns the controls. Engineering owns the design and tenancy answers. Legal owns the DPA and subprocessor terms.

Presales runs the file. Name one person. The same post noted "there's usually nobody whose actual job this is."

5. Answer from how controls actually run

Say what really happens, not what the policy says. Name the tool, how often it runs and who owns it. For each control, say who owns it: you, your cloud host or the customer.

6. Review, submit and save

Have someone from security read the file. Check that answers match your SOC 2 report and trust center. Save the final answers to your library, and track how long each one takes. For the full process, see how to respond to a security questionnaire.

How do you answer questions that don't apply, or where the honest answer is "No"?

On-prem and datacenter questions. Answer "inherited from [your cloud provider]" and point to the provider's audit report. Do not just write "N/A." A one-line reason saves a follow-up email.

Customer-owned controls. Say so plainly. Under shared responsibility, the customer keeps its own identities, accounts and data. For example, user access settings inside your product belong to the customer.

An honest "No." Pair it with a compensating control, a planned date, or a risk the customer can accept. One practitioner described the option to "let the customer accept certain risks and implement their own controls."

Do not overclaim. Another practitioner put it simply: "never let the questionnaire be more mature than the company." Answers can become contract representations, so a stretched "Yes" is the real risk.

Can AI answer a SaaS security questionnaire?

A general chatbot can help with wording. It does not know your controls, and it can invent answers that sound right. As one practitioner put it, "A tool that flags unsupported claims is useful. One that guesses is dangerous."

There are four common ways to speed up the work. Each helps in some places and falls short in others:

• A spreadsheet answer library. Cheap and familiar. It goes stale when several copies exist.
• A trust center. Good for sharing proof before anyone asks. Buyers still send custom questionnaires.
• A GRC platform. Strong for monitoring controls and collecting evidence. If your control data lives there, its questionnaire features can be the simplest option.
• AI RFP software. Drafts answers from your approved content. It is only as good as that content.

SiftHub is an AI RFP software that automates RFP, RFI, DDQ, and security questionnaire responses for B2B SaaS presales, solutions engineering, and bid teams. It is built for mid-market and enterprise teams that answer these often. For a SaaS security questionnaire, that looks like this:

• It fills answers in Excel, Word, PDF, Google Sheets and Google Docs, and in web portals through a browser extension.
• Each answer shows its source document and version, owner and last-modified date, with an audit trail.
• It returns "no answer found" and flags the question instead of guessing.
• Open questions route to subject matter experts in Slack or Teams.
• SiftHub auto-fills 80% of answers on the first pass, depending on how complete your approved content is. ActivTrak reached 95% questionnaire completion.

See how SiftHub fills security questionnaires from your approved content.

For more on tooling, read about security questionnaire automation and compare security questionnaire automation software.

The short version

A SaaS security questionnaire asks what a generic one does, plus tenancy, shared responsibility, subprocessors and AI. Have the evidence pack ready before it lands.

Be clear about who owns each control, never overclaim, and keep one answer set current.

See how SiftHub turns your approved security content into a first draft of your next SaaS security questionnaire.

Frequently Asked Questions