.jpg)
.avif)
- The Vendor Security Alliance questionnaire is a free, standardized security assessment that buyers send to vendors.
- The Vendor Security Alliance is a nonprofit coalition announced in 2016 by nine founding companies, including Airbnb, Atlassian, Square and Uber.
- It comes in two versions: VSA-Full goes deep on security, and VSA-Core (since October 2019) covers critical controls plus US and EU privacy.
- VSAQ can also mean Google's separate open-source Vendor Security Assessment Questionnaire tool, archived in 2022.
- The guide compares VSA with SIG, CAIQ and HECVAT and gives vendors a 6-step process for answering it.
- SiftHub is an AI RFP software that drafts security questionnaire answers from approved content, with sources and SME review.
- The Vendor Security Alliance questionnaire is a free, standardized security assessment that buyers send to vendors.
- The Vendor Security Alliance is a nonprofit coalition announced in 2016 by nine founding companies, including Airbnb, Atlassian, Square and Uber.
- It comes in two versions: VSA-Full goes deep on security, and VSA-Core (since October 2019) covers critical controls plus US and EU privacy.
- VSAQ can also mean Google's separate open-source Vendor Security Assessment Questionnaire tool, archived in 2022.
- The guide compares VSA with SIG, CAIQ and HECVAT and gives vendors a 6-step process for answering it.
- SiftHub is an AI RFP software that drafts security questionnaire answers from approved content, with sources and SME review.
The spreadsheet arrives with a tab called VSA-Full or VSA-Core. The deal is close, and the buyer's security team wants answers before legal signs. If you have not seen a Vendor Security Alliance questionnaire before, it is easy to lose a week working out what it is and what good answers look like.
The pressure behind it is real. Third parties were involved in 48% of breaches in Verizon's 2026 Data Breach Investigations Report, up from 30% the year before. Standard questionnaires like the VSA give buyers one way to check many vendors the same way.
This guide is written for the vendor side: presales, solutions engineering and the security or GRC person who owns the answers. It covers what the VSA questionnaire is, how VSA-Full and VSA-Core differ, how it compares with SIG, CAIQ and HECVAT, and a process for answering it well.
The Vendor Security Alliance questionnaire is a free, standardized security assessment that buyers send to vendors. The Vendor Security Alliance, a nonprofit founded in 2016 by companies including Uber, Airbnb and Atlassian, publishes it. It has two versions: VSA-Full goes deep on security, and VSA-Core covers critical controls plus privacy.
In this guide:
- What is the Vendor Security Alliance questionnaire?
- Who is the Vendor Security Alliance?
- VSA vs Google's VSAQ
- VSA-Full vs VSA-Core
- What VSA-Full covers
- VSA vs SIG, CAIQ and HECVAT
- How to answer it
- How to speed it up
What is the Vendor Security Alliance questionnaire?
In practice, the Vendor Security Alliance questionnaire is a standard set of security and privacy questions that a buyer can send to any vendor, instead of writing its own. The vendor fills it in and returns it with supporting evidence.
A few things set it apart:
- It is free. The VSA publishes two free questionnaires, VSA-Full and VSA-Core.
- It is meant to be updated annually. The VSA says both versions are refreshed every year. The first questionnaire came out on October 1, 2016.
- It is a spreadsheet. You answer a mix of yes or no questions and open questions in a downloadable file.
- The download is gated. You fill in a short form, confirm your email, and accept the VSA's disclaimer and limited license.
- It is per product. A vendor with several products or services usually completes one questionnaire for each.
The VSA does not publish a current edition number or a question count on its site. Always download the latest file before you start, rather than reusing a copy from a past deal, and check the edition year in the file name.
If you want to compare it with other formats first, see these information security questionnaire templates.
Who is the Vendor Security Alliance?
The VSA calls itself "a coalition of companies committed to improving Internet security." It is organized as a nonprofit, and any company that shares its mission can apply for membership.
It was announced on September 15, 2016 by nine founding companies: Airbnb, Atlassian, Docker, Dropbox, GoDaddy, Palantir, Square, Twitter and Uber. The founders wanted one shared way to assess vendor security, so each company did not have to build its own.
The VSA also runs a service for its members. Here is how it works, according to the VSA site:
- The member sends its vendor list. The VSA first checks whether it has recently audited any of those vendors. If so, the member can see that report once the vendor agrees to share it.
- The vendor completes the questionnaire online, through the VSA's software partner.
- An assigned auditor reviews the answers and may interview the vendor to check them.
- The member gets an executive summary plus the detailed answers.
For a vendor, this matters in a practical way. If a member uses this review service, expect an auditor to read your answers closely and possibly call you. And one audited VSA can be shared with other member buyers, with your consent, instead of repeating the work.
Is the VSA questionnaire the same as VSAQ?
Not always. Many people say VSAQ when they mean the Vendor Security Alliance questionnaire. Search for "vsaq" and some of the top results describe the VSA questionnaire under that name.
But VSAQ is also the name of a different tool. In March 2016, Google Security open-sourced VSAQ, the Vendor Security Assessment Questionnaire. It is a set of web questionnaires that adapt as you answer. It has four templates. They cover web apps, your security program, your infrastructure and your data centers. Its GitHub repository was archived in November 2022, and its README says it is not an official Google product.
So if a buyer sends you a "VSAQ questionnaire", check which one they mean. If the file has VSA-Full or VSA-Core in the name, it is the Vendor Security Alliance version. That is the one this guide covers.
What is the difference between VSA-Full and VSA-Core?
The two versions answer different needs. Here is how the VSA questionnaire versions compare.
The VSA launched VSA-Core in partnership with OneTrust on October 24, 2019, with a free edition hosted on OneTrust's platform. The VSA describes it as "the most critical questions on vendor security in addition to privacy."
Which one should you push for? If the buyer mainly cares about privacy and baseline controls, VSA-Core is a fair ask. If they handle sensitive data or run a deep review, expect VSA-Full. Either way, if you already have one completed and current, offer it first.
[Image placeholder 1: VSA-Full vs VSA-Core comparison]
What does the VSA-Full questionnaire cover?
VSA-Full is organized into eight sections, according to the section lists published by UpGuard and Vanta. Here is what each one is about, where to be careful, and the evidence that usually backs the answers.
- Service Overview: What your product does, where it runs and what data it touches. It scopes everything else, so be precise about data types and hosting regions.
- Data Protection and Access Control: How you encrypt data, manage keys, log people in and limit who can reach customer data. Expect follow-up questions if answers here are vague.
- Policies and Standards: This is your written security program, who owns each policy and how often you review it. Make sure each policy you mention exists and is current.
- Proactive Security: This is what you do before something goes wrong. Think of vulnerability scans, pen tests and staff training.
- Reactive Security: This is what you do when something goes wrong, from incident response to telling customers and getting back up.
- Software Supply Chain: How you manage the code and services you get from others, such as open-source packages and subprocessors.
- Customer Facing Application Security: How you build and test the product your customers use.
- Compliance: This covers your audits, certifications and the rules you must follow.
Share sensitive items, such as a full SOC 2 report or architecture details, under an NDA. For examples of the kinds of questions these sections ask, see these security question examples.
How is the VSA questionnaire different from SIG, CAIQ and HECVAT?
The VSA is one of several standard questionnaires. Here is how it compares with the three you are most likely to see next to it.
A few notes on the others:
- SIG from Shared Assessments has 21 risk domains in its 2026 edition, including AI. It scopes into Lite, Core and Detail versions. See our guide to the SIG questionnaire.
- CAIQ v4.1 maps to the CSA's Cloud Controls Matrix v4.1. The CSA STAR registry accepts v4.0 and v4.1 until December 2027, then only v4.1, per the CSA transition timeline.
- HECVAT version 4 merged the Full, Lite and On-Prem versions into one file and added privacy and AI questions.
Be honest about the VSA's limits too. The site gives no edition number, and the published section list has no AI section, so buyers with AI concerns may add their own questions on top.
[Image placeholder 2: VSA vs SIG, CAIQ and HECVAT comparison]
The security blog High Signal Security suggests asking prospects which standard formats they accept, citing a list that includes CAIQ, the VSA questionnaire, CIS Controls and SIG. It also suggests leading with your trust center and audit reports. That one question can save you from filling in a custom sheet. For the wider picture, see our vendor due diligence questionnaire guide.
How do you answer the VSA questionnaire as a vendor?
Most guides stop at the definition. Here is a process for actually answering a Vendor Security Alliance questionnaire well.
1. Confirm the version, scope and deadline
Check whether it is VSA-Full or VSA-Core, and which edition year the file is. Confirm which product or service it covers, which data types are in scope, and how to submit it. VSA members can send the hosted version, so you may answer online instead of in a spreadsheet.
Raise the security review on the first call if you can. A Presales Collective article notes the questionnaire can show up just a week before you expected to sign, which leaves little room.
2. Check what you can reuse
Before you write anything new, look for:
- A VSA questionnaire you completed for another buyer.
- A current CAIQ or SIG response.
- Your SOC 2 report and ISO 27001 certificate.
- Content on your trust center.
Offer these first. Some buyers will accept them. Buyers also search for completed VSA questionnaires from specific vendors, so publishing yours on a trust center can save a request.
3. Answer from how your controls actually run
Write answers that describe what your team does, not what a policy says in general terms. A GRC practitioner writing as GRC Destroyer makes the same point: export how a control is implemented, not just the high-level control description.
Sort questions into three groups before you start: ones you can answer yourself, ones for the security team, and ones for legal. That way each owner gets their questions at once, not in drips.
4. Answer "No" honestly, with a compensating control and a date
A column of yeses does not help you. The High Signal Security author writes that if a questionnaire is just yeses down the line, they start to get suspicious. Reviewers look for dealbreakers, not perfect scores.
When the answer is no, say so. Then name the control that reduces the risk, and give a date if a fix is planned. "We do not offer customer-managed keys today. Data is encrypted at rest with keys managed in [cloud KMS], with access limited to [roles] and logged." is far stronger than a vague yes.
5. Attach evidence, and keep sensitive items behind an NDA
Use the evidence table above. Match each attachment to the section it supports. Share SOC 2 reports, full pen test reports and architecture details only under an NDA.
6. Prepare for the auditor, then save your final answers
If the buyer uses the VSA's review service, an auditor may review your answers and interview you. Make sure the person on that call knows the answers and the evidence.
When the review closes, save the final version to your answer library. The next VSA, SIG or custom questionnaire can start from it. For more on keeping answers current, see how to reuse security questionnaire responses.
How can you speed up VSA questionnaire responses?
The VSA questionnaire is a spreadsheet, and many teams still manage this work in spreadsheets too. Mitratech's 2025 study found 41% of organizations still use spreadsheets for third-party risk. There are better options, and each fits a different job.
Trust centers and GRC platforms are the better choice for proactive sharing and control monitoring. AI RFP software fits mid-market and enterprise teams that answer security questionnaires, RFPs and DDQs from one library.
SiftHub is an AI RFP software that automates RFP, RFI, DDQ, and security questionnaire responses for B2B SaaS presales, solutions engineering, and bid teams. For a security questionnaire like the VSA, that looks like this:
- It drafts answers from your approved content and shows the source document behind each one.
- When it cannot find a confident answer, it says so instead of guessing.
- It routes open questions to subject matter experts for review, with an audit trail of who changed what.
- It fills answers into Excel, Word, Google Sheets and Google Docs, so you work in the buyer's file.
- Across questionnaires and RFPs, teams typically see 80% auto-fill on the first pass.
See how SiftHub drafts security questionnaire answers from your approved content.
[Image placeholder 3: real SiftHub screenshot of an answer with its source document]
For more on tooling, read about security questionnaire automation or compare AI tools for security questionnaire management. For an example of a vendor trust page, see SiftHub's security and compliance page.
The short version
The Vendor Security Alliance questionnaire is free, standard and, per the VSA, updated every year.
Know which version you have. Reuse what you already answered. Describe how your controls really work, including the gaps. Attach evidence, and save the final answers for next time.
