Security questionnaire (vendor risk assessment, SIG, CAIQ)
A list of security and privacy questions a company sends a vendor before buying, to judge the risk of trusting it with data and access.
Large buyers use standard templates: the SIG from Shared Assessments, the CAIQ from the Cloud Security Alliance, the VSA questionnaire, or their own spreadsheet with hundreds of rows. Questions cover encryption, access control, SSO, backups, incident response, subprocessors, penetration tests and now AI: which models, where data goes, whether it trains them. A SOC 2 report or ISO 27001 certificate answers many questions at once; vendors keep a reusable answer library or a public trust center.
Related terms
- SOC 2 and ISO 27001: The two security attestations enterprise buyers ask vendors for: an auditor’s SOC 2 report and an ISO/IEC 27001 certificate.
- Data processing agreement (DPA): The contract GDPR requires when a vendor processes personal data on your behalf: what, why, how it is protected, who else gets it.
- Penetration test (pentest): An authorized, time-boxed attack on your app by security testers, ending in a report of what they could break and how badly.
- Mutual action plan (MAP, close plan): A shared, dated list of steps both buyer and vendor take from first call to signed contract and go-live, with an owner for each step.
- Vendor onboarding (procurement): The paperwork a company’s procurement team needs before it can pay a new vendor: forms, tax and bank details, insurance, data agreements and approvals.
