Security Questionnaires Guide: SIG, CAIQ and HECVAT

Security questionnaires consume weeks of effort on both sides of every deal, yet a spreadsheet of "Yes" answers rarely tells a buyer whether a supplier can be trusted with its data or its network. Standard formats such as the Shared Assessments SIG, the Cloud Security Alliance CAIQ, the EDUCAUSE HECVAT and the VSA questionnaires reduce the duplication, and assurance reports such as SOC 2 and ISO/IEC 27001 certificates can replace many questions entirely. This guide covers both sides: how suppliers answer efficiently and accurately, and how buyers issue proportionate questionnaires, score third-party risk and verify what they are told. It also covers trust centres, AI questions in questionnaires, and how to use AI to draft answers without publishing wrong ones. It is written for GRC, security assurance, procurement and third-party risk teams.

Key takeaways

• Accept a standard before writing your own. SIG, CAIQ, HECVAT and VSA cover most of what a custom questionnaire asks, and suppliers often have them completed already.
• Independent assurance beats self-attestation. A SOC 2 Type 2 report or ISO/IEC 27001 certificate, read properly for scope, exceptions and carve-outs, answers more than a hundred self-reported answers.
• Tier suppliers first. Assessment depth should follow inherent risk: data sensitivity, access to your systems and business criticality, not contract value.
• Ask about identities and integrations. Many third-party breaches run through API keys, OAuth tokens and support access, which generic questionnaires cover weakly.
• AI can draft, people must approve. Every AI-drafted answer needs a named owner, a source in the approved answer library and a human accuracy review, because the answer becomes a contractual representation.

The standard questionnaires compared

• SIG and SCA: Shared Assessments describes a "Trust, but Verify" model: the SIG is the trust step, and its Standardized Control Assessment is the verify step for onsite or virtual testing. The 2026 SIG, released 19 September 2025, added references to ISO/IEC 42001 for AI and updated the ISO/IEC 27001:2022 Annex A mapping.
• HECVAT reuse: EDUCAUSE intends suppliers to complete HECVAT 4 once a year and share the same file with every institution, while institutions choose which categories they score and can flag "non-negotiable" items.
• CAIQ answers need context: a Yes/No answer is only useful with the comment explaining scope and whether the control is the provider's or the customer's responsibility.

Assurance reports as alternatives to questionnaires

A report that ended nine months ago leaves a gap; ask for a bridge letter covering the period since. The AICPA has warned that "SOC services should be thoroughly evaluated by service organizations and CPA firms" after allegations about a compliance vendor offering SOC services, so check who signed the report and whether the firm is a licensed CPA firm.

Answering questionnaires: a supplier's operating model

Questionnaire fatigue is a supplier problem and a buyer problem: suppliers answer the same questions in many different formats, and buyers receive rushed answers. Requests arrive as standalone security reviews, as sections of RFPs, and as contract renewals. Treat them as one workflow with one source of truth, owned by security assurance rather than whichever sales engineer receives the request.

• Build an answer library: one approved answer per control topic, with an owner, a last-reviewed date, the evidence that supports it and the products or regions it applies to. Map entries to SIG, CAIQ, HECVAT and VSA question IDs so a completed standard can be produced in hours.
• Pre-complete the standards: keep a current CAIQ (and a STAR Level 1 entry if you sell cloud services), a HECVAT if you sell to education, and a SIG if you sell to financial services. Refresh them on a fixed annual date and after major changes.
• Lead with evidence: answer "see SOC 2 Type 2, section 4, CC6.1" rather than writing a paragraph. Buyers trust tested controls more than prose.
• Answer precisely: "Yes, for production; corporate laptops are in progress, target Q2" is a better answer than an unqualified "Yes" that later proves false. Partial answers with compensating controls survive audits and disputes.
• Route exceptions: questions outside the library go to a named subject matter expert with a deadline, and the new answer is added to the library after approval.
• Control what you send: share audit reports under NDA through a portal with access logging, watermarking and expiry, not as email attachments.

Trust centres

A trust centre is a supplier-run page or portal that publishes security posture and gives gated access to evidence. Done well, it answers most low-risk reviews without a questionnaire; the CSA STAR Registry serves the same purpose for cloud providers.

• Public: security overview, certifications held, sub-processor list, vulnerability disclosure policy, status page, privacy notice, a contact for security questions.
• Gated (NDA or click-through): SOC 2 report, ISO certificate and Statement of Applicability, penetration test summary, completed SIG, CAIQ or HECVAT, policies.
• Never published: network diagrams, detailed configuration, full penetration test reports, anything that would help an attacker more than a customer.
• Keep it current: stale certificates and expired reports on a trust centre undermine every other answer. Show "last updated" dates.

Issuing questionnaires: tiering and proportionate assessment

NIST SP 800-161 Rev. 1 "integrates cybersecurity supply chain risk management (C-SCRM) into risk management activities" across enterprise, mission and business process, and operational levels, and includes an SCRM Assessment Scoping Questionnaire (Table 26). The practical lesson is to decide assessment depth from inherent risk before sending anything.

• Accept equivalents: state that you accept SIG, CAIQ, HECVAT or VSA in place of your own form, and ask only the delta questions.
• Verify the high-risk answers: request the evidence behind the five to ten answers that matter most for that supplier (MFA, logging, backups, incident notification), not all of them.
• Combine with monitoring: questionnaires are point-in-time. External attack surface ratings, breach news and certificate expiry alerts fill the gap between assessments, but treat ratings as signals to investigate, not as verdicts.
• Write findings into the contract: incident notification times, right to audit, sub-processor approval and remediation dates for open findings.

Third-party risk scoring

Keep scoring simple enough to explain to a business owner. Score inherent risk before the assessment, then residual risk after it.

Avoid averaging: a supplier with perfect answers everywhere except MFA on administrative access is not "92% secure". Use knock-out questions that force a high residual score regardless of the rest.

Where identity fits: questions that standard forms underweight

The CCM has an IAM domain and SIG covers access control, but third-party breaches increasingly involve machine credentials and integrations. The Salesloft Drift breach spread through stolen OAuth tokens from one chatbot integration, and in the Snowflake breach infostealer credentials worked against customer accounts without MFA. Add targeted questions:

• Integration credentials: how are API keys, OAuth tokens and service account credentials that access customer data stored, scoped, rotated and revoked? See the API Key Management Guide.
• OAuth scopes: which scopes does the integration request in our tenant, and can it work with fewer? See the SaaS and OAuth App Governance Guide.
• Support and administrative access: can staff access customer data, under what approval, with what MFA, and is it logged and visible to us? See the Third-Party Access Guide.
• Customer-side controls: can we enforce SSO and MFA for all users, disable local accounts and receive audit logs?
• Offboarding: how are customer credentials and tokens destroyed at contract end?

AI in security questionnaires

AI questions buyers now ask

Standard questionnaires now cover AI. The 2026 SIG references ISO/IEC 42001; HECVAT 4 includes AI-specific questions written by community volunteers; and CSA's STAR for AI builds on the AI Controls Matrix, an AI-CAIQ and ISO/IEC 42001, with AI-CAIQ self-assessments at Level 1. Whether or not a standard form is used, buyers should ask:

• Data use: is our data used to train or fine-tune models, and can we opt out contractually?
• Model providers: which third-party models and sub-processors process our data, and where?
• Agents and actions: can AI features act in our systems, with what identity and permissions, and with what human approval? See the Agentic AI Security Guide.
• Prompt injection and output controls: how are untrusted inputs, retrieved documents and outputs filtered and logged?
• Governance: is there an AI management system, an inventory of AI features and an incident process that covers AI misbehaviour? See the AI Supply Chain and AI-BOM Guide.

Using AI to draft answers safely

AI drafting tools match incoming questions to past answers well, and CSA itself now offers Valid-AI-ted, an AI evaluation of CAIQ v4 submissions. The risk is an answer that sounds right and is false, which then becomes a representation in a contract.

• Ground answers only in the approved library: retrieval from current, owner-approved answers and evidence, not open web content or old questionnaires.
• Show the source: each drafted answer cites the library entry and evidence it came from, so the reviewer can check it.
• Human approval is mandatory: a named reviewer approves every answer before it leaves; flag low-confidence matches and any answer changing a "No" to "Yes".
• Protect the inputs: questionnaires and audit reports are confidential. Use a tool whose terms exclude training on your data, with access limited to the assurance team.
• Measure accuracy: sample approved answers each quarter and count corrections. If the correction rate rises, tighten matching thresholds or revert those question categories to manual drafting.

How to implement: a phased approach

1. Inventory (month 1): list suppliers, owners, data and access for each; on the supplier side, gather the last 12 months of questionnaires received.
2. Tier and policy (month 2): agree tier criteria, accepted standard formats, knock-out questions and reassessment cycles with procurement and legal.
3. Build the answer library and trust centre (months 2 to 4): start with the 100 most frequent questions, attach evidence, and pre-complete CAIQ, SIG or HECVAT as your market needs.
4. Pilot (month 4): run the new process on one business unit or new contracts only, in parallel with the old process, and compare effort and findings.
5. Introduce AI drafting in audit mode (months 5 to 6): AI drafts, humans write independently for a sample, and you compare. Enable it per question category once accuracy is proven; keep the ability to switch a category back to manual.
6. Roll out and monitor (month 6 onwards): extend to all tiers, add external monitoring for critical suppliers, and report metrics to the risk committee.

Decision guidance

• Which standard to send: cloud service, CAIQ; higher education, HECVAT; financial services or broad enterprise TPRM, SIG; smaller technology suppliers, VSA-Core.
• Questionnaire or report: if a supplier has a recent SOC 2 Type 2 or ISO certificate covering the service, review it first and ask only the gaps.
• Small organisations: as a buyer, use free standards (VSA, HECVAT where eligible, CAIQ internally) and focus on critical suppliers. As a supplier, one completed CAIQ or VSA plus a simple trust page removes most requests.
• Large organisations: a TPRM platform helps with workflow and tracking, but the tiering logic, knock-out questions and contract terms must come from your policy.

Measurement and framework mapping

Metrics

• Coverage: percentage of critical and high-tier suppliers with a current assessment.
• Cycle time: median days from request to completed assessment (buyer) or to returned questionnaire (supplier).
• Reuse rate: percentage of incoming questions answered from the library without new drafting.
• Answer accuracy: corrections per 100 approved answers in quarterly sampling.
• Open findings: overdue supplier remediation items by tier.
• Incident notification: supplier incidents notified to you within the contractual time.

Framework mapping

Common failure patterns

• Same questionnaire for every supplier: low-risk suppliers drown in questions and critical ones get no deeper scrutiny.
• Collecting reports without reading them: a SOC 2 with exceptions on access reviews, or one that carves out the hosting provider, is filed as a pass.
• Self-attestation treated as fact: answers are never checked against evidence, so a false "Yes" on MFA surfaces only after an incident.
• Ignoring integrations: the questionnaire assesses the supplier's corporate security but not the tokens and connected apps it holds in your tenant.
• Stale answer libraries: answers written for last year's architecture, now replayed by an AI tool at scale.

Practitioner checklist

• Tier every supplier by data, access and criticality before sending anything.
• Publish which standard questionnaires and assurance reports you accept.
• Read SOC 2 reports for scope, exceptions, carve-outs and complementary user entity controls.
• Define knock-out questions, including MFA on administrative access and incident notification.
• Add questions on API keys, OAuth tokens, support access and AI data use.
• Write findings, notification times and audit rights into contracts.
• Maintain an owned, dated answer library mapped to SIG, CAIQ, HECVAT and VSA.
• Require human approval and source citation for every AI-drafted answer.
• Track coverage, cycle time, accuracy and overdue findings.

Standards and references

• NIST: SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
• Shared Assessments: What is the SIG?
• Cloud Security Alliance: Cloud Controls Matrix and CAIQ
• Cloud Security Alliance: STAR Levels
• EDUCAUSE: Higher Education Community Vendor Assessment Toolkit
• AICPA and CIMA: SOC Suite of Services
• ISO: ISO/IEC 27001:2022 Information security management systems

Related NHI Mgmt Group resources: Third-Party Access Guide · SaaS and OAuth App Governance Guide · AI Supply Chain and AI-BOM Guide · API Key Management Guide