If you sell software to larger companies, you will meet the same few questionnaire families again and again, often with the customer's own edits layered on top. Knowing what each one is for makes them less intimidating, and it shows how much of the work overlaps. This guide covers the Standardized Information Gathering questionnaire (SIG) in its full and Lite forms, and the Consensus Assessments Initiative Questionnaire (CAIQ), and closes with how to organize your evidence so one set of sources answers all three.
SIG and SIG Lite
The SIG is published by Shared Assessments and is widely used by financial services, healthcare, and large enterprises to assess third-party risk. It is organized into risk domains such as enterprise risk management, information assurance, access control, application security, privacy, business resiliency, and threat management. The full questionnaire is long, often many hundreds of questions, and customers usually scope it down to the domains relevant to the service they are buying.
SIG Lite is the shorter version, built for initial due diligence or lower-risk vendors. It asks fewer, broader questions across the same domains. For many B2B software vendors, SIG Lite is the first real security review they receive, and a well-sourced SIG Lite answer set becomes the backbone of everything that follows.
Practical notes for SIG-family files:
- Answers are usually a Yes, No, or N/A column plus a free-text comments column. Fill both; a bare Yes invites a follow-up.
- Customers frequently add their own tabs or columns. Keep their structure intact and answer where they asked.
- Many questions ask about documented policies. Point to the specific policy section, and make sure its approval and review dates are current.
CAIQ
The CAIQ comes from the Cloud Security Alliance and maps to the Cloud Controls Matrix (CCM). Version 4 groups questions by CCM control domains, such as audit and assurance, business continuity, cryptography and key management, data security and privacy, identity and access management, and infrastructure security. It is common with cloud and SaaS buyers, and vendors can publish a completed CAIQ in the CSA STAR registry as a self-assessment.
Because the CAIQ is tied to a control framework, its questions tend to be precise about mechanisms: how keys are managed, how tenant data is separated, how logs are protected. Architecture notes matter more here than in SIG Lite. If your evidence only says data is encrypted, expect follow-ups asking with what algorithm, under whose keys, and how often they rotate.
Custom spreadsheets and portals
Many customers send their own spreadsheet, often a remix of SIG and CAIQ questions in their own words, sometimes with a scoring column you are not meant to fill. Others use procurement portals that accept answers one field at a time. The questions are rarely new; the wording is. This is where keyword search and copy-paste libraries break down, because the same question about multi-factor authentication can be phrased a dozen ways.
Where they overlap
Across all three, the same core topics carry most of the weight:
- Governance: a documented, approved, regularly reviewed security program.
- Access control: single sign-on, multi-factor authentication, least privilege, and access reviews.
- Cryptography: encryption at rest and in transit, key management and rotation.
- Resilience: backups, disaster recovery, RPO and RTO, and how often recovery is tested.
- Assurance: independent audits such as SOC 2, penetration testing, and vulnerability management.
- Third parties: how you assess vendors and disclose subprocessors.
- Data lifecycle: hosting location, residency, retention, and deletion after termination.
Prepare evidence once
Instead of maintaining one answer set per questionnaire family, maintain one evidence set that covers these topics with specific, current statements. In practice that means four kinds of source: your policy set, your SOC 2 report summary or bridge letter, architecture notes written for a security reader, and your most recent accepted questionnaire. Give each one an owner and a review date.
Write your sources the way a reviewer would want to quote them. A sentence like customer data at rest is encrypted with AES-256 using keys managed in a cloud key management service, rotated annually, answers a SIG question, a CAIQ question, and a custom question about key rotation all at once. A sentence like we take encryption seriously answers none of them.
Know what you cannot answer
Every questionnaire family includes questions some vendors cannot answer yes to: FedRAMP authorization, specific insurance limits, certifications you have not achieved. The right answer is an honest one, routed to the person who owns it, not an optimistic yes. A reviewer at your customer will trust the rest of your answers more for it.
Attestloom treats these as gaps by design. If a question names a framework that none of your sources mention, it is marked Needs owner with the reason. Your team decides what to say, and the decision is recorded.
Keep reading
See it work on a sample questionnaire in the live demo.