Enterprise buyers send long security questionnaires because suppliers are now a major route for attackers. Verizon's 2025 Data Breach Investigations Report found third-party involvement in 30% of breaches, roughly double the year before. For a small vendor, a questionnaire can stall a deal for weeks. This guide explains the common formats, the evidence buyers trust, and how to prepare answers once and reuse them.
Why buyers send questionnaires
A buyer's risk team must show its auditors and regulators that it checked each supplier with access to its data. Rules push in the same direction. The GDPR requires processors to work under binding contracts and documented instructions, and the proposed HIPAA Security Rule would make covered entities verify business associates' safeguards at least every 12 months.
Costs explain the rest. IBM's 2025 Cost of a Data Breach study put the global average cost of a breach at $4.44 million, and the US average at $10.22 million. A buyer would rather spend a few weeks on review than inherit that risk.
The common questionnaire formats
Most questionnaires are based on a few standard sets. The Shared Assessments SIG is widely used in financial services and comes in three sizes. The CSA CAIQ targets cloud providers and can be published on the CSA STAR Registry. Many buyers also send their own spreadsheet, which usually maps back to one of these.
The SIG 2025 release added questions on incident management and operational resilience and mapped to NIST CSF 2.0, DORA and NIS2. Knowing which framework sits behind a buyer's form lets you reuse answers, map gaps quickly and avoid writing the same policy statement five different ways.
| Format | Publisher | Size |
|---|---|---|
| SIG Lite | Shared Assessments | 128 questions |
| SIG Core | Shared Assessments | 627 questions across 21 risk domains |
| SIG Detail | Shared Assessments | 1,936 questions |
| CAIQ v4 | Cloud Security Alliance | 261 questions, down from 310 |
| Custom buyer form | The buyer | Varies, often mapped to SIG or ISO 27001 |
Evidence that shortens reviews: SOC 2 and ISO 27001
A third-party report answers dozens of questions at once. A SOC 2 report describes the controls a service organisation has in place against the trust services criteria for security, availability, processing integrity, confidentiality and privacy. A Type 2 report tests whether controls operated effectively over a period. KPMG notes many companies start with a Type 1 before moving to Type 2.
ISO/IEC 27001 is a certifiable standard for an information security management system. The 2022 edition, published on 25 October 2022, has 93 Annex A controls in four themes: organisational, people, physical and technological. The transition from the 2013 edition ended on 31 October 2025, so buyers now expect 2022 certificates.
Build a trust pack before the first enterprise deal
A trust pack is a folder, or a page on your site, that holds everything a reviewer asks for. Include a security overview, architecture diagram, data flow map, sub-processor list, policies, latest penetration test summary, business continuity plan and insurance certificate. Add a completed SIG Lite or CAIQ so buyers can start from your answers.
Publishing a CAIQ on the CSA STAR Registry, at Level 1, lets cloud buyers check your self-assessment without asking. Keep version dates on every document so reviewers know it is current, and share sensitive items such as test reports under an NDA rather than publicly.
- Security overview and architecture diagram
- Policies with owner and review date
- Penetration test summary from the last 12 months
- Completed SIG Lite or CAIQ v4
- Sub-processor list and DPA template
How to answer well
Answer honestly and specifically. A plain "No, planned for Q1 with a named owner" earns more trust than a vague yes that falls apart in a follow-up call. Where a control is handled by your cloud provider, say so and point to the provider's own report under the shared responsibility model.
Keep a single answer library and update it after each review. Short answers, linked evidence and consistent wording across forms make you look organised. Once the library exists, even a full SIG Lite becomes an editing job rather than a research project.
Controls reviewers check first
Reviewers tend to focus on a short list: multi-factor authentication for staff and admin accounts, encryption in transit and at rest, logging and alerting, vulnerability management, access reviews, backups with tested restores, incident response and supplier management. Close these gaps before investing in paperwork.
Attackers increasingly target AI features too. IBM's 2025 study found 13% of organisations reported breaches of AI models or applications, and 97% of those lacked proper AI access controls. XDQ Labs runs authorised AI security reviews that help vendors document and fix these gaps.
Frequently asked questions
What is a vendor security questionnaire?
It is a set of questions an enterprise buyer sends a supplier to judge its security before sharing data or systems. Common bases include the Shared Assessments SIG and the CSA CAIQ. Answers are usually backed by evidence such as a SOC 2 report or ISO 27001 certificate.
How many questions are in the SIG Lite?
According to Mitratech's summary of SIG 2025, SIG Lite has 128 questions for vendors needing lighter review, SIG Core has 627 questions across 21 risk domains, and the full SIG Detail has 1,936. Buyers choose the version based on the vendor's risk level.
Do small vendors need SOC 2 or ISO 27001 to win enterprise deals?
Not always, but either one answers many questions at once and speeds reviews. Many companies start with a SOC 2 Type 1, which describes controls at a point in time, then move to a Type 2 that tests them over a period. ISO 27001:2022 certification is another widely recognised option.
What is the CAIQ?
The Consensus Assessments Initiative Questionnaire is the Cloud Security Alliance's questionnaire for cloud providers. Version 4, released on 7 June 2021, has 261 questions, down from 310. Providers can submit it to the CSA STAR Registry as a Level 1 self-assessment.
Sources
- Verizon's 2025 Data Breach Investigations Report: System intrusion breaches double in EMEA, Verizon, 2025
- Cloud Security Alliance Emphasizes Accountability and Transparency with Consensus Assessment Initiative Questionnaire (CAIQ) v4, Cloud Security Alliance, 2021
- SIG 2025: Key Updates and Considerations, Mitratech, 2024
- Navigating the ISO/IEC 27001:2022 Transition: A 90-Day Challenge, ISACA Journal, 2024
- SOC 2: System and Organization Controls Reporting (white paper), KPMG US, 2025
- IBM Report: 13% of organizations reported breaches of AI models or applications, 97% of which reported lacking proper AI access controls, IBM Newsroom, 2025
- HIPAA Security Rule Notice of Proposed Rulemaking to Strengthen Cybersecurity for Electronic Protected Health Information (fact sheet), HHS Office for Civil Rights, 2024
- Regulation (EU) 2016/679 (General Data Protection Regulation), English text, Personal Data Protection Office (UODO), Poland, 2016
