.avif)
- A vendor security assessment questionnaire is how a buyer checks a supplier's data protection before signing or renewing a contract.
- In Verizon's 2026 DBIR, 48% of breaches involved a third party, up from 30% a year earlier.
- Common standard formats are SIG (Lite, Core, Detail), CAIQ v4.1, AI-CAIQ, VSA and HECVAT.
- The post includes an 81-question template across 10 domains with strong-answer guidance and evidence to attach.
- A seven-step vendor workflow: triage, reuse existing reports, answer from an approved library, route gaps, review, and save final answers.
- SiftHub is an AI RFP software that drafts security questionnaire answers from approved content in Excel, Word, PDF, Google Sheets and vendor portals.
- A vendor security assessment questionnaire is how a buyer checks a supplier's data protection before signing or renewing a contract.
- In Verizon's 2026 DBIR, 48% of breaches involved a third party, up from 30% a year earlier.
- Common standard formats are SIG (Lite, Core, Detail), CAIQ v4.1, AI-CAIQ, VSA and HECVAT.
- The post includes an 81-question template across 10 domains with strong-answer guidance and evidence to attach.
- A seven-step vendor workflow: triage, reuse existing reports, answer from an approved library, route gaps, review, and save final answers.
- SiftHub is an AI RFP software that drafts security questionnaire answers from approved content in Excel, Word, PDF, Google Sheets and vendor portals.
The 300-row spreadsheet tends to land just as the deal starts moving. The champion is ready. Legal is ready. Then the buyer's security team sends a vendor security assessment questionnaire, and the clock starts.
A vendor security assessment questionnaire is a set of questions a company sends a supplier to check how it protects data before signing or renewing a contract. It covers access control, encryption, incident response, business continuity, subprocessors, privacy and, increasingly, AI use. Vendors answer with policies, certifications such as SOC 2, and supporting evidence.
The pressure behind these forms is real. In Verizon's 2026 Data Breach Investigations Report, 48% of breaches involved a third party, up from 30% a year earlier. Buyers know their vendors are part of their attack surface, and they ask accordingly.
This guide is for the team that has to answer. You get the questions buyers ask, what a strong answer looks like and the evidence to attach. It also covers the standard formats you will meet and a workflow that keeps answers consistent from deal to deal.
In this guide
- What is a vendor security assessment questionnaire?
- Who sends security assessment questionnaires, and why now?
- Which standard security questionnaires will you see?
- Vendor security assessment questionnaire template
- How do you answer a security assessment questionnaire as a vendor?
- What happens if you fail a security questionnaire?
- How can you speed up security questionnaire responses?
What is a vendor security assessment questionnaire?
A vendor security assessment questionnaire is how a buyer checks your security before it trusts you with its data. It often arrives after the technical win and before the contract. It comes back at renewal, and again when you add a new product or a new subprocessor.
For SaaS vendors, it is often one of the last gates before signature. A strong answer set keeps the deal on schedule. A weak one adds weeks of follow-up.
It is not the same as a vendor due diligence questionnaire. A due diligence questionnaire also covers finance, legal, ownership and ESG. A security assessment stays on how you protect data and systems.
It is also not the security section of an RFP. That section is usually shorter and scored. A security assessment goes deeper, and your answers can be written into the contract.
Most questions trace back to a few frameworks:
- SOC 2. The AICPA Trust Services Criteria cover five categories: Security, Availability, Processing Integrity, Confidentiality and Privacy.
- ISO/IEC 27001:2022. Controls A.5.19 to A.5.23 deal with supplier security. Your buyer uses them to manage you.
- NIST CSF 2.0. Supply chain risk sits in the Govern function, under GV.SC.
When you know which framework a question comes from, you know what evidence will satisfy it.
Who sends security assessment questionnaires, and why now?
The form may come from third-party risk, the security team, procurement, privacy or legal. In smaller buyers, one person wears all of those hats. In large ones, you may get the same question from three teams.
Three forces explain why the questions keep coming.
Third-party breaches. Verizon's 2026 report found that only 23% of third parties had fully fixed missing or weak MFA on cloud accounts. Expect detailed MFA and access questions as a result.
Regulation. The EU's Digital Operational Resilience Act has applied since January 17, 2025. It makes financial firms manage ICT third-party risk.
NIS2 Article 21(2)(d) requires supply chain security for essential and important entities. If you sell into the EU, your buyers have legal reasons to ask.
One piece of good news: a January 2026 European Commission proposal to amend NIS2 calls for guidelines on a consistent format for supplier information requests, to cut duplicate questionnaires. It is a proposal, not law yet.
AI. Verizon found that the share of employees using AI tools frequently rose from 15% to 45% in a year. IBM's 2026 Cost of a Data Breach report put the global average breach cost at $4.99 million. About one in five organizations reported an AI-related breach. Separately, more buyers now ask whether your product trains on their data.
Buyers are also stretched. In a Drata survey of 309 companies, reported by IT Brief, 78% said they could not carry out as many third-party assessments as they wanted. And 58% had no standard process for AI risk in third-party products. That gap shows up on your side as new, custom questions, especially about AI.
On your side, the volume adds up fast. In the 2025 TPRM Impact Report from Whistic, a third-party risk software vendor (525 respondents), vendors received 37.3 assessment requests a month. They spent 179 hours a month answering them, and 84% of responses needed follow-up.
[Image placeholder 1: questionnaire lifecycle, from request to follow-up]
Which standard security questionnaires will you see?
Many buyers send a standard form, or a cut-down version of one. Knowing them saves time, because you can keep a completed copy ready.
| Questionnaire | Owner | Version | Approx. questions | What it covers | Where you may see it |
|---|---|---|---|---|---|
| SIG Lite | Shared Assessments | SIG 2026 (counts are SIG 2025) | 128 | High-level controls | Screening lower-risk vendors |
| SIG Core | Shared Assessments | SIG 2026 (counts are SIG 2025) | 627 | Deeper controls across 21 risk domains | Financial services and large enterprises |
| SIG Detail | Shared Assessments | SIG 2026 (counts are SIG 2025) | 1,936 | Full control set | Critical vendors in regulated industries |
| CAIQ | Cloud Security Alliance | v4.1 (January 2026) | 283 | 207 cloud controls across 17 domains | Cloud and SaaS buyers |
| AI-CAIQ | Cloud Security Alliance | AICM v1.1 | 320 | AI controls mapped to the EU AI Act, NIST AI RMF and ISO 42001 | Buyers of AI products |
| VSA-Full and VSA-Core | Vendor Security Alliance | Updated yearly | Not verified | VSA-Full is security. VSA-Core adds privacy (GDPR, CCPA, US breach rules) | Technology buyers |
| HECVAT | EDUCAUSE | 4.1.6 | Varies by tab | Security, privacy, accessibility, compliance and AI in one file | Colleges and universities |
A few practical notes:
- SIG changes every November. SIG 2025 added mappings to DORA, NIS2 and NIST CSF 2.0. Shared Assessments has not published 2026 question counts. The 2026 version adds an ISO 42001 mapping for AI management and formal Lite, Core and Detail presets. Check which year the buyer sent before you reuse old answers. Our guide to SIG questionnaire automation goes deeper.
- CAIQ is the one to finish in advance. The CAIQ v4.1 can be submitted to the CSA STAR Registry as a Level 1 self-assessment. Some buyers check the registry before they send anything custom.
- VSA launched in 2016 with founding members including Airbnb, Atlassian, Dropbox, Square and Uber. It is free and updated each year.
- HECVAT is widely used in higher education. EDUCAUSE asks vendors to update it at least once a year.
[Image placeholder 2: the standard questionnaires compared by size and owner]
Vendor security assessment questionnaire template
Use this vendor security assessment questionnaire template to prepare before the next request lands. Each domain lists the questions buyers ask most, what a strong answer includes and the evidence to attach. Fill it in once, get it approved, and you have a first draft for most custom forms.
For more formats, see our information security questionnaire templates.
Company and security program
| Question | What a strong answer includes | Evidence to attach |
|---|---|---|
| Do you have a documented information security program? | Who owns it, when it was last reviewed, what frameworks it follows | Information security policy |
| Who is responsible for security? | Name or title of the security lead and who they report to | Org chart or role description |
| Which certifications or audits do you hold? | SOC 2 type and period, ISO 27001 scope and expiry | SOC 2 report, ISO certificate |
| How often do you review security policies? | A set cycle, usually yearly, plus reviews after major changes | Policy version history |
| Do employees get security training? | Training at hire and yearly, with completion tracking | Training records summary |
| Do you run background checks on staff? | Which roles, which checks, where local law allows | HR security policy |
| Do you carry cyber insurance? | Yes or no, and the coverage type | Certificate of insurance |
| Do you have a public trust center? | A link to your security page and what it holds | Trust center URL |
| Do you run a formal risk assessment? | How often, who owns it, and how risks are tracked to closure | Risk assessment summary |
| How do you secure your offices and data centers? | Office access controls, and reliance on cloud provider data center controls | Physical security policy |
Access control and identity
| Question | What a strong answer includes | Evidence to attach |
|---|---|---|
| Do you enforce MFA for all staff? | MFA on email, SSO, cloud consoles and admin tools | Access control policy |
| Do you use single sign-on? | Which identity provider and which apps sit behind it | SSO configuration summary |
| How do you grant and remove access? | Role-based access, approval steps, removal within a set time after exit | Joiner, mover, leaver procedure |
| How often do you review user access? | Quarterly or better for production and sensitive data | Access review records |
| Who can access customer data? | Named roles, least privilege, logged access | Data access policy |
| How do you manage privileged accounts? | Separate admin accounts, just-in-time access, session logs | Privileged access procedure |
| Does your product support SSO and MFA for customers? | Supported protocols such as SAML or OIDC, and enforcement options | Product security documentation |
| How do you secure remote access? | SSO, device checks and no shared credentials | Remote access policy |
Data protection and encryption
| Question | What a strong answer includes | Evidence to attach |
|---|---|---|
| Is customer data encrypted at rest? | The standard, such as AES-256, and what it covers | Encryption policy |
| Is data encrypted in transit? | TLS 1.2 or higher on all external connections | Architecture overview |
| How do you manage encryption keys? | Managed key service, rotation, who has access | Key management procedure |
| Where is customer data stored? | Cloud provider, regions and whether customers can choose | Data residency statement |
| How do you separate customer data? | Logical or physical separation, and how it is tested | Architecture overview |
| How long do you keep customer data? | Retention by data type, and deletion on request or exit | Data retention policy |
| How do you delete data at contract end? | Timeline, method and confirmation to the customer | Deletion procedure |
| Do you classify data? | Classification levels and how they drive handling | Data classification policy |
| Do you use data loss prevention controls? | Where DLP runs, such as email, endpoints or cloud storage | DLP policy summary |
Application security and development
| Question | What a strong answer includes | Evidence to attach |
|---|---|---|
| Do you follow a secure development lifecycle? | Design review, code review, testing before release | SDLC policy |
| Do you run code scanning? | Static and dependency scanning in the build pipeline | Tool list and pipeline summary |
| How do you manage open-source risk? | Dependency tracking and patch timelines | Software composition analysis summary |
| Are production and test separate? | Separate environments, no customer data in test | Environment policy |
| How are changes approved? | Peer review, change tickets, rollback plan | Change management procedure |
| Do developers get secure coding training? | Topics and frequency | Training records summary |
| How do you protect secrets in code? | Secrets manager, scanning for leaked keys | Secrets management procedure |
| Do you test your APIs for security issues? | Authentication, rate limits and testing in scope of pen tests | API security summary |
Vulnerability management and testing
| Question | What a strong answer includes | Evidence to attach |
|---|---|---|
| Do you run third-party penetration tests? | Yearly at least, by an independent firm, covering the product | Pen test summary or letter |
| How often do you scan for vulnerabilities? | Continuous or weekly scans of infrastructure and apps | Scanning policy |
| What are your patch timelines? | Days to fix by severity, such as critical within a set window | Vulnerability management policy |
| Do you have a vulnerability disclosure program? | How researchers report issues and how you respond | Disclosure policy or URL |
| How do you track findings to closure? | Ticketing, owners and reporting to leadership | Remediation tracking summary |
| Do you monitor and log security events? | Central logging, alerting, retention period | Logging and monitoring policy |
| How do you secure employee devices? | Device management, disk encryption and endpoint protection | Endpoint security policy |
| Do you harden servers and cloud configuration? | Baseline configurations and automated checks for drift | Configuration standard |
Incident response and breach notification
| Question | What a strong answer includes | Evidence to attach |
|---|---|---|
| Do you have an incident response plan? | Roles, steps, severity levels and last review date | Incident response plan summary |
| How fast will you notify customers of a breach? | A clear window, such as within 72 hours of confirmation | Contract clause or policy |
| Do you test the plan? | Tabletop exercises at least yearly | Exercise summary |
| Have you had a breach in the last few years? | A direct answer, plus what changed if yes | Incident statement |
| Who is the security contact for customers? | A monitored address or channel | Contact details |
| Do you keep forensic logs? | What is logged and how long it is kept | Logging policy |
| Who responds to security alerts outside business hours? | An on-call rotation and escalation path | On-call procedure |
Business continuity and resilience
| Question | What a strong answer includes | Evidence to attach |
|---|---|---|
| Do you have a business continuity plan? | Scope, owner and last test date | BCP summary |
| What are your recovery time and recovery point objectives? | RTO and RPO in hours | Disaster recovery plan |
| How often do you back up data? | Frequency, encryption and restore testing | Backup policy |
| Is your service hosted in more than one zone or region? | High-availability setup and failover | Architecture overview |
| What uptime do you commit to? | SLA percentage and service credits | SLA document |
| Do you publish service status? | A public status page and incident history | Status page URL |
| Do you test disaster recovery? | Restore and failover tests, at least yearly, with results | DR test summary |
Subprocessors and fourth parties
| Question | What a strong answer includes | Evidence to attach |
|---|---|---|
| Which subprocessors handle customer data? | A current list with purpose and location | Subprocessor list |
| How do you assess your own vendors? | Risk tiers, reviews before onboarding and at renewal | Vendor management policy |
| Will you notify us of new subprocessors? | Notice period and how customers can object | DPA clause |
| Do your subprocessors meet the same standards? | Contract terms and their certifications | Vendor review records |
| Which cloud provider do you use? | Provider, regions and the shared responsibility split | Cloud provider certifications |
| Do any AI or LLM providers process our data? | Which ones, what data, and what their terms allow | AI subprocessor list |
| How do you monitor subprocessors over time? | Yearly review of their audit reports and any incidents | Vendor review records |
Privacy and compliance
| Question | What a strong answer includes | Evidence to attach |
|---|---|---|
| Do you sign a data processing agreement? | Yes, with standard terms ready to share | DPA template |
| How do you comply with GDPR? | Lawful basis, data subject rights, transfer safeguards | Privacy policy, transfer mechanism |
| Do you comply with CCPA? | Service provider terms and consumer rights handling | Privacy policy |
| Do you have a privacy lead or DPO? | Name or role and contact | Privacy contact |
| How do you handle data subject requests? | Process, owner and response time | DSR procedure |
| Are you subject to DORA or NIS2 obligations? | Whether they apply to you, and how you support customers who are in scope | Regulatory statement |
| Do you run privacy impact assessments? | When they are triggered and who signs off | DPIA procedure |
| Do you allow customer audits? | Whether you share audit reports instead, and any on-site audit terms | Audit rights clause |
AI and model use
| Question | What a strong answer includes | Evidence to attach |
|---|---|---|
| Does your product use AI? | Which features, and whether customers can turn them off | AI feature overview |
| Do you train models on customer data? | A plain yes or no, and the contract term that backs it | AI use policy, DPA clause |
| Which model providers do you use? | Named providers and their data terms | AI subprocessor list |
| How long do prompts and outputs stay stored? | Retention period and where they live | Data retention policy |
| Do humans review AI outputs? | When review happens and who does it | Workflow description |
| How do you control access to AI features? | Permissions, admin settings and logging | Product security documentation |
| Do you follow an AI governance framework? | Any mapping to ISO 42001, NIST AI RMF or the EU AI Act | AI governance policy |
| How do you handle AI errors or harmful outputs? | Reporting path and fix process | Incident response plan |
| Do you test AI features for prompt injection or data leakage? | Test scope, frequency and who runs it | AI testing summary |
The AI section is changing fast. The Cloud Security Alliance's AI-CAIQ alone has 320 questions. If your product uses AI, write these answers before a buyer asks.
How do you answer a security assessment questionnaire as a vendor?
Treat it as a project with an owner and a deadline. These seven steps keep it moving.
- Triage first. Check the format: a spreadsheet, a portal or a standard like SIG or CAIQ. Note the deadline and the deal size. A 40-row form for a small deal should not get the same SME time as a SIG Core for a large one.
- Offer what you already have. A SOC 2 report, an ISO 27001 certificate, a trust center or a completed CAIQ on the STAR Registry may cover much of the form. Ask the buyer if they will accept it for the matching sections.
- Answer from an approved library. Do not answer from memory or from last quarter's spreadsheet. Old answers drift. A single approved source keeps every deal consistent. Our guide on how to reuse security questionnaire responses covers how to set one up.
- Route only the gaps. Send SMEs the questions the library cannot answer, with a deadline. Nobody wants a 300-row file with "can you check this?" at the top.
- Separate company controls from product controls. "Do you encrypt data?" can mean your laptops or your product. Say which one you are answering. Reviewers flag this mix-up often.
- Review before you submit. Check that answers agree with each other and with your SOC 2 report. A clear "no" with context beats a vague "yes". Buyers trust a vendor who admits a gap and shares a plan.
- Save the final answers. Every approved answer goes back into the library, with the date and the owner. The next questionnaire starts from there.
The common complaint from security and presales teams is the same one: the questions repeat, just reworded. Step 3 and step 7 are where that repetition turns into speed.
What happens if you fail a security questionnaire?
A weak answer rarely ends the conversation on its own. It usually leads to one of these:
- Follow-up questions. In Whistic's report, 84% of responses needed follow-up. Answer them fast and with evidence.
- A remediation plan. The buyer asks you to fix a gap by a date. Commit only to dates your team will meet.
- Compensating controls. You show another control that reduces the same risk. For example, strict network rules where a feature is missing.
- Contract terms. The buyer accepts the risk but adds clauses, such as tighter breach notice or audit rights.
- A stalled or lost deal. This happens when the gap is serious, or when answers are slow and vague.
To recover, own the gap in writing. Explain the risk in plain terms, what you do today and when the fix lands. Then follow up before the buyer has to chase you. Our guide to risk due diligence responses covers this in more detail.
How can you speed up security questionnaire responses?
There are four common ways to do it. Most teams use more than one, and each has a real strength.
| Option | Where it wins | Where it falls short |
|---|---|---|
| Shared spreadsheet library | Free, familiar, no new tool | Goes stale fast, hard to search, no clear owner |
| Trust center | Can head off requests before a form is sent. Some now answer questionnaires too | Many buyers still send their own custom form |
| GRC tool | Owns your controls and audit evidence. Some, such as Drata, now draft questionnaire answers | Answers draw mainly on control data, less on product and sales content |
| AI RFP software | Drafts answers from approved content in the buyer's format, across RFPs, DDQs and security forms | Needs setup and a maintained library. One more tool to buy |
For a deeper comparison, see our list of AI tools for security questionnaire management and our guide to security questionnaire automation.
SiftHub is an AI RFP software that automates RFP, RFI, DDQ, and security questionnaire responses for B2B SaaS presales, solutions engineering, and bid teams.
For security questionnaires, it works in the format the buyer sent: Excel, Word, PDF, Google Sheets or a browser-based vendor portal. It matches each question to approved answers and evidence, such as security policies, SOC 2 reports and pen test summaries. Your team bulk-approves high-confidence answers and routes the rest to SMEs. Every answer links to its source, with an audit trail.
SiftHub practices what it answers. It holds SOC 2 Type II and ISO 27001:2022, and it does not use customer data to train its models. You can see this on SiftHub's own security and compliance page.
See how SiftHub answers security questionnaires in Excel, Word and vendor portals.
[Image placeholder 3: real screenshot of the SiftHub Excel add-in answering a security questionnaire]
Turn the next questionnaire into a first draft
A vendor security assessment questionnaire does not have to stall the deal. Know the standard formats. Keep a current, approved answer for every domain in the template above. Route only the real gaps to your SMEs, and save every final answer.
Do that, and the next 300-row spreadsheet starts as a first draft, not a blank page. See how SiftHub drafts security questionnaire answers from your approved content.
