What is a security questionnaire?
Glossary
The short answer |
|---|
A security questionnaire is a structured set of questions a customer or partner sends to a vendor to assess its security, privacy and compliance practices before sharing data or signing a contract. It is a core part of vendor and third-party risk management. Questionnaires can be custom or standardized, such as the SIG, the CSA CAIQ or HECVAT, and answers are often backed by evidence. |
How does a security questionnaire work?
The buyer’s security or procurement team sends a form, spreadsheet or portal link.
The vendor answers each question, often attaching policies, reports or screenshots as evidence.
The buyer reviews the answers, asks follow-up questions and rates the vendor’s risk.
Answers may be referenced in the contract, and the review is usually repeated each year.
Common questionnaire formats
Format | Published by | Typical use |
|---|---|---|
SIG | Shared Assessments | Broad third-party risk reviews |
CAIQ | Cloud Security Alliance | Cloud service providers, mapped to the Cloud Controls Matrix |
HECVAT | EDUCAUSE | Vendors selling to higher education |
Custom | The buyer | Most enterprise deals |
What do security questionnaires usually ask?
Access control: multi-factor authentication, single sign-on, access reviews.
Data protection: encryption at rest and in transit, data location, retention.
Application security: secure development, code review, vulnerability management, penetration testing.
Operations: logging, monitoring, backups, incident response.
People: background checks, security training, offboarding.
Compliance: SOC 2, ISO 27001, GDPR, HIPAA and similar.
Why do security questionnaires matter for startups?
For a startup selling to larger companies, the questionnaire is often the longest step between a verbal yes and a signed contract. Slow or inconsistent answers stall deals. The real fix is not faster typing, it is having the underlying controls and evidence in place so every answer is accurate and quick to support.
How NexusVoid handles it
Aegis, NexusVoid’s compliance automation product, answers questionnaires from the evidence it already collects from cloud, GitHub, identity and devices, so answers reflect what is actually configured. It also includes a trust center, tailored policies and auditor-ready exports to share alongside your answers.
Related terms
Trust center
Compliance automation
SOC 2 Type 1 vs Type 2
Shared controls
Penetration testing
Frequently asked questions
How long does it take to answer a security questionnaire?
It varies widely. A short custom form might take an hour. A full standardized questionnaire can run to hundreds of questions and take days when answers are scattered across people and documents. Having a library of approved answers, current policies and evidence on hand is what brings that down to hours.
What is the difference between SIG and CAIQ?
The SIG, published by Shared Assessments, is a broad third-party risk questionnaire covering areas such as physical security and business continuity, and is available to members and licensees. The CAIQ, from the Cloud Security Alliance, focuses on cloud service providers and maps to the CSA Cloud Controls Matrix. Cloud-only vendors often get the CAIQ, while broader reviews use the SIG.
Can I answer a questionnaire with my SOC 2 report instead?
Sometimes. Many buyers accept a current SOC 2 Type 2 report, or ISO 27001 certificate, in place of some or all questions, because it is independent evidence. Others still require their own form. Offering the report early, through a trust center or under NDA, often shortens the review even when the questionnaire is still required.
Is it okay to answer yes to controls we are still building?
No. Answers in a security questionnaire often become part of the contract, and an inaccurate answer can create legal and commercial risk later. Say what is true today, describe work in progress with a realistic timeline, and explain compensating controls. Buyers generally respect an honest partial answer more than a claim that falls apart under review.
Have a questionnaire sitting in your inbox right now? Book a call at /contact and we will show you how to answer it from evidence.
Something wrong in this post? Tell us at lakshay@nexusvoidai.com and we will fix it and say so.
More terms
ASPM
ASPM pulls the findings from all your application security tools into one prioritized view, so a small team fixes the risks that matter first.
Attack surface management
Attack surface management continuously finds everything you expose to the internet, including what you forgot about, and flags what an attacker could use.
Autonomous CISO
An autonomous CISO is software that runs the day-to-day work of a security program, so startups get continuous security, with compliance following from it.
Start with a real security program.
Tell us what you need to fix first and we will show that part live, on a stack like yours.