Security Risk Assessment Questionnaire: What It Asks and How Vendors Answer It

Your deal is in legal. Then procurement forwards a spreadsheet titled "Security risk assessment," due Friday. If you sell B2B software to mid-market and enterprise buyers, this file shows up in many late-stage deals.

Most guides on this topic are written for the buyer who sends it. This one is for the vendor who answers it: presales, solutions engineers and the security or GRC owner who signs off.

A security risk assessment questionnaire is a set of questions a buyer sends a vendor to measure the security risk of using its product. It covers controls such as access, encryption, incident response and suppliers. The buyer scores the answers and evidence to decide whether to approve the vendor, add conditions, or ask for more.

Buyers are checking harder for a reason. Third parties were involved in 48% of breaches in Verizon's 2026 Data Breach Investigations Report, up 60% year over year. Each vendor a buyer adds widens its attack surface, and the questionnaire is how the buyer checks yours.

In this guide:

• What is it?
• How is it different from a security risk assessment?
• Why do buyers send them?
• What are the types?
• What does it ask?
• Which standard questionnaires will you see?
• How do buyers score your answers?
• How do you answer one as a vendor?
• What if your honest answer is "No"?
• Can ChatGPT or AI answer it?

What is a security risk assessment questionnaire?

A risk assessment questionnaire is the buyer's way of collecting the facts it needs to judge risk. NIST defines risk assessment as "the process of identifying, estimating, and prioritizing risks" from the operation of an information system, in its glossary entry. The questionnaire is how a buyer gathers those facts about you.

The buyer's security, GRC or procurement team sends it. On the vendor side, presales often coordinates the answers, with input from security, engineering and legal.

It often lands late in the deal, after the technical evaluation. It can arrive next to a request for your SOC 2 report or ISO 27001 certificate. One practitioner on Hacker News described enterprise buyers asking for SOC 2 or ISO, pen test results and a trust center link "before we even send a security questionnaire."

The format varies:

• A spreadsheet, sometimes with hundreds of rows.
• A Word file with long-form questions.
• An online vendor risk portal, where you answer inside the buyer's tool.

If you want the full question bank, our guide to the vendor security assessment questionnaire has it. This post covers what makes a risk assessment questionnaire different and how to answer it well.

How is it different from a security risk assessment or a security questionnaire?

These three terms get used as if they mean the same thing. They don't, and the difference shapes how you answer.

A security risk assessment is the buyer's whole process. The questionnaire is one input to it, the part you supply. The buyer adds its own context, such as what data you will touch, and turns your answers into a risk rating.

"Security questionnaire" is the broad term for any set of security questions. A risk assessment questionnaire is one the buyer scores for risk and uses to tier vendors.

For the wider category, see our guide to the information security questionnaire.

Why do buyers send security risk assessment questionnaires?

Third parties now show up in nearly half of breaches. That 48% DBIR figure is the headline. The frameworks buyers follow point the same way.

NIST's Cybersecurity Framework 2.0, released in February 2024, added a new Govern function. Inside it, the GV.SC category covers supply chain risk. CSF 2.0 says suppliers should be "known and prioritized by criticality" (GV.SC-04) and calls for due diligence before a supplier relationship starts (GV.SC-06). A questionnaire is a common way to do that due diligence.

NIST also publishes SP 800-161 Rev. 1 on supply chain risk, with a fillable assessment scoping questionnaire posted in December 2025.

Many buyer programs still run on basic tools. A survey by TPRM software vendor Mitratech found 41% of organizations still manage third-party risk in spreadsheets. A standard questionnaire gives those teams a record of the due diligence they did on you. Read it as a request for evidence, not a verdict on your product.

What are the types of security risk assessment questionnaires?

Buyers use different names for overlapping question sets. You will see "cyber risk assessment questionnaire," "IT risk assessment questionnaire" and several others. Here are five common types, and the framework each one usually draws on.

Cyber security risk assessment questionnaire

This is the broadest type. A cyber security risk assessment questionnaire can be organized around the six NIST CSF 2.0 functions: Govern, Identify, Protect, Detect, Respond and Recover.

Expect questions about who owns your security program, how you manage risk, how you find and fix vulnerabilities, and how you respond to incidents. Some buyers call it a cybersecurity risk assessment questionnaire. The content is the same.

Cloud security risk assessment questionnaire

Cloud and SaaS vendors get this one. It may be the Cloud Security Alliance's CAIQ. CAIQ v4.1 has 283 questions, based on the 207 controls in 17 domains of CCM v4.1, per CSA's CCM v4.1 page.

Shared responsibility takes the most care. You need to say which controls you run, which the customer runs, and which your cloud provider runs. Our CAIQ questionnaire guide covers the format in detail.

Information security risk assessment questionnaire

An information security risk assessment questionnaire usually follows ISO/IEC 27001:2022. Its Annex A has 93 controls in four themes: Organizational, People, Physical and Technological, per Kiwa.

One date matters here. The transition from ISO 27001:2013 ended on October 31, 2025, so 2013 certificates have expired. If a buyer asks for your certificate, send the 2022 version.

Application security risk assessment questionnaire

This type looks at the product itself. Expect questions on secure development, authentication, session handling, input validation, dependency management and pen testing.

Some buyers map these questions to OWASP's Application Security Verification Standard. ASVS 5.0 came out in May 2025. It has three levels, and OWASP recommends Level 2 for most apps that handle sensitive data or significant B2B transactions.

Keep product controls and company controls apart here. A SiftHub user on G2 pointed out that organizational controls and product controls "are slightly different," which can trip up answer accuracy. "Do you require MFA?" can mean MFA for your employees or MFA inside your product. Answer the one they asked.

IT risk assessment questionnaire

An IT risk assessment questionnaire covers endpoints, networks, asset inventory, backups and access to internal systems. It overlaps a lot with the cyber type. Government-built tools follow the same pattern. CISA's CSET, for example, is a desktop tool for a structured review of IT and OT systems.

What does a security risk assessment questionnaire ask?

Whatever the name on the file, the same security risk assessment questions come up. Here are nine common areas, and the evidence that answers each.

Some questions are written in the buyer's own terms. One practitioner described a question about the buyer's internal "level 3" data class, which meant nothing outside that company. Ask before you guess. A wrong guess costs more time than a short email.

For sample wording across these areas, see our security question examples.

Which standard questionnaires will you see?

Many buyers skip writing their own and send a standard one. Here are four standard questionnaires, plus the buyer's own sheet.

Sources: CSA STAR, Vorp Labs SIG tracker, the Vendor Security Alliance, EDUCAUSE and Mitratech on SIG 2026.

The answers overlap heavily. Encryption, access, incident response and vendor management show up in every standard above. One master answer set covers a large share of each. Our guides to the SIG questionnaire and the VSA questionnaire go deeper on those formats.

How do buyers score your answers?

Buyers score on two kinds of risk. Inherent risk is the exposure before any controls, based on what you touch and how critical you are. Residual risk is what remains after your controls. NIST defines residual risk as the "portion of risk remaining after security measures have been applied," in its glossary.

Buyers typically tier vendors by inherent risk first. A vendor that stores customer data lands in a higher tier than one that sends a newsletter. Tiering sets "the type, scope and frequency of assessments required for each group," per Mitratech's guide to inherent vs residual risk. SIG's Lite, Core and Detail presets let a buyer scale the questionnaire to match.

Your answers then shape the residual risk rating. A few things help:

• Evidence attached to the answers that need it.
• Specific answers that name the tool, the frequency and the owner.
• An honest "No" paired with a compensating control.

Vague answers do the opposite. They invite follow-up rounds, and each round can add days to the deal.

What are the steps of a security risk assessment?

You will see "5 steps" and "7 steps" models online. There is no single official version. NIST's Guide for Conducting Risk Assessments (SP 800-30 Rev. 1) describes four steps: prepare for the assessment, conduct it, communicate and share the results, and maintain it.

Your questionnaire feeds the conduct step. Your updates at renewal feed the maintain step. That is why buyers come back at renewal, or on a schedule set by your tier, with the same file.

How do you answer a security risk assessment questionnaire as a vendor?

Many teams treat each questionnaire as a one-off fire drill. One practitioner said teams "ignore it until a pilot is blocked." Then "they need a yes yesterday." A steady process works better.

1. Confirm scope, format and deadline

Before anyone writes an answer, confirm the basics:

• Which product or service the answers cover.
• Which data you will touch.
• Which standard, if any, the file follows.
• Portal or file, and the due date.

Ask about any term you do not recognize.

2. Send what you already have first

Send your SOC 2 report, ISO 27001 certificate, pen test summary and trust center link before you start. Many buyers still send the questionnaire. As one practitioner put it, a SOC 2 "won't save you from vendor questionnaires ... but it will make them easier."

3. Start from a master answer set

Keep one reviewed library of answers. It beats hunting through old questionnaires every time. A SiftHub reviewer on G2 described the old way: teams "hunt through countless policies, reports, and past questionnaires to answer the same questions over and over."

If you answer these often, it pays to reuse security questionnaire responses from one library instead of old spreadsheets.

4. Route each section to an owner

Map each section to the person who runs those controls:

• Security owns access and incident response.
• Engineering owns the SDLC and architecture.
• Legal owns data processing and notification terms.
• HR owns background checks and training.

Presales coordinates. They chase answers and keep the file moving, so a senior engineer is not pulled into every row.

5. Answer from how controls actually run

Describe what happens, not what the policy says should happen. "Access reviews run quarterly in our identity provider, owned by IT" beats "Access is reviewed periodically per policy." Keep product controls and company controls separate.

6. Attach evidence to the answers that need it

Buyers often want "answers and evidence into a spreadsheet, sometimes an online app," as one practitioner described it. Match each claim to a document. If you say you run annual pen tests, attach the summary letter.

7. Review, submit and save

Have someone from security review the full file before it goes out. Check that answers match your SOC 2 report and trust center. Then save the final answers back to your library.

Track turnaround time too. A questionnaire should never be the reason a pilot slips. For the full process, see how to respond to a security questionnaire.

What if your honest answer is "No"?

An over-claimed "Yes" that unravels during due diligence costs more than a "No" ever would. It can also become a contract problem later.

When the answer is "No," pair it with one of these:

• A compensating control that covers the same risk.
• A planned date for the control.
• Context on why the risk is low for this product.

Some questions ask about outdated practices. Forced password rotation is a common one. NIST's current guidance is SP 800-63B-4. It says verifiers "SHALL NOT require subscribers to change passwords periodically." One vendor on Hacker News answers that question "no" and links to the NIST guidance. They say "no one has ever complained."

Explain every "N/A" in one line. A short reason saves a follow-up email.

Can ChatGPT or AI answer a security risk assessment questionnaire?

A general chatbot can help with wording. It does not know your controls, and it can invent answers that sound right. In a security questionnaire, an invented answer is a liability. Every approved answer needs a source.

There are four common ways to speed one up. Each helps in some places and falls short in others:

• A spreadsheet answer library. Cheap and familiar. It breaks down when several copies exist and nobody knows which one is current.
• A trust center. Good for sharing proof before anyone asks. It does not stop the custom questionnaires that still arrive.
• A GRC platform. Strong for monitoring controls and collecting audit evidence. If your control data already lives there and is clean, its built-in questionnaire features can be the simplest option.
• AI RFP software. Drafts answers from your approved content. It only works as well as the content behind it.

SiftHub is an AI RFP software that automates RFP, RFI, DDQ, and security questionnaire responses for B2B SaaS presales, solutions engineering, and bid teams. For this kind of file, that looks like this:

• Answers fill straight into Excel, Word, Google Sheets and Google Docs, so you keep the buyer's file.
• Every answer cites its source document and version, with an audit trail.
• When there is no reviewed answer, SiftHub returns "no answer found" instead of guessing.
• Open questions go into an approval flow for subject matter expert review.
• SiftHub auto-fills 80% of answers on the first pass, depending on how complete your approved content is.

See how SiftHub fills security questionnaires from your approved content.

For a wider view of the category, read our guides on security questionnaire automation and AI tools for security questionnaire management.

The short version

This questionnaire is how a buyer decides whether you are safe to sign. Know which type you are facing, and send your SOC 2 and certificates first.

Answer from how your controls actually run, and be honest about gaps. Then keep one answer set current so the next file takes far less time.

See how SiftHub turns your approved security content into a first draft of every security risk assessment questionnaire.

Frequently Asked Questions