How to Answer a Vendor Security Questionnaire When You Have Never Seen One Before
Published September 14, 2026 · 9 min read
A customer's procurement team just forwarded you a spreadsheet with 200 rows of security questions and a deadline attached. You have never filled one of these out. You are not sure what half the questions are asking. And the deal is large enough that “we'll get back to you” is not an answer.
This is the inbound side of vendor risk: a customer is assessing you. It is the mirror image of assessing your own vendors, which is the outbound side — same noun, opposite direction, different job. This guide covers the inbound questionnaire: what you are looking at, how to work through it efficiently, and how to handle the questions where you fail.
What Just Landed in Your Inbox
There are three formats you are likely to receive. Identifying which one you have saves time, because each one has a different structure and a different strategy.
SIG and SIG Lite (Shared Assessments)
The Standardized Information Gathering questionnaire is maintained by the Shared Assessments Program. SIG is the full version — it can run to 800+ questions across 19 risk domains (access control, application security, business continuity, privacy, and so on). SIG Lite is the subset: roughly 200 questions covering the same domains at a higher level.
You can identify a SIG by its structure: it arrives as an Excel workbook with one tab per risk domain, a standardized header row, and a “Scoping” column that asks you which domains apply. The domain tabs are labeled things like “A. Enterprise Risk Management” and “H. Access Control”. If you see that tab structure, you have a SIG.
CAIQ (Cloud Security Alliance)
The Consensus Assessments Initiative Questionnaire comes from the Cloud Security Alliance (CSA). It maps to the CSA Cloud Controls Matrix (CCM) and is structured as a flat list of yes/no questions organized by control domain. Current versions run around 260 questions.
You can identify a CAIQ by the control IDs: they use a three-letter domain prefix followed by a number, like IAM-01, DSP-04, or CCC-02. If the spreadsheet has a “CCM Control ID” column and asks for yes/no plus a free-text explanation, it is a CAIQ.
Bespoke Questionnaires
Everything else: a spreadsheet or Word document the customer's security team wrote themselves. These vary wildly. Some are tight — 30 focused questions about encryption, access controls, and incident response. Others are 400 questions adapted from a framework you have never heard of.
The good news about bespoke questionnaires is that they tell you exactly what this customer cares about. The questions they wrote (as opposed to copied from a template) are the ones you need to answer well.
The Triage: Sort Before You Answer
Do not start at row 1 and work down. Questionnaire rows fall into three categories, and sorting them first prevents you from spending an hour on a question that should have taken ten seconds.
| Category | What it looks like | What to do |
|---|---|---|
| Answerable from existing documents | "Describe your password policy." "Do you encrypt data at rest?" "What is your data retention period?" | Pull the answer from your policies. If you have an Access Control Policy, a Data Handling & Privacy Policy, or an Incident Response Plan, most of these are a copy-paste with a citation. |
| Requires a real technical answer | "What encryption algorithm and key length do you use for data in transit?" "Describe your key management process." | Route to an engineer. These need specific facts, not policy language. |
| Not applicable to your business | "Describe your physical access controls to data center facilities." "Do you support FIPS 140-2 validated cryptographic modules?" | Answer "Not applicable" with a one-sentence reason. See the next section. |
This sort alone usually cuts a 200-question questionnaire into roughly 120 policy-sourced answers, 40 technical answers, and 40 not-applicable responses. The ratio shifts depending on your infrastructure, but the pattern holds.
How to Answer “Not Applicable” Without Sounding Evasive
Procurement teams see blank rows and naked “N/A” responses as red flags, because they cannot tell the difference between “this does not apply” and “we skipped this because we do not have an answer.” The fix is a sentence that demonstrates you understood the question and explains why it does not apply.
Good: “Not applicable. We do not operate physical data centers; all infrastructure is hosted on AWS, whose physical security controls are covered under their SOC 2 Type II report (available on request).”
The structure is always the same: Not applicable, then the reason, then where the control lives instead. A well-written N/A is a stronger answer than many “yes” responses, because it shows you know what the question is actually asking and can point to a compensating control.
What to Do About Questions You Fail
This is the section most guides skip, and it is where the trust is won. You are going to hit questions where the honest answer is “no, we do not do that yet.” How you handle those questions matters more than having a perfect score on the rest.
The Compensating Control Answer
A compensating control is a different measure that addresses the same risk. If the question asks whether you have a dedicated SIEM and you do not, but you have centralized logging with alerting on anomalous access patterns, say that. The structure:
- Acknowledge the gap directly. “We do not currently operate a dedicated SIEM.”
- Describe what you do instead. “Application and infrastructure logs are centralized in CloudWatch with automated alerts on privilege escalation, failed authentication spikes, and unauthorized API access patterns.”
- Explain why it addresses the risk. “This provides real-time detection of the same event categories a SIEM would surface, scoped to our current infrastructure footprint.”
Procurement teams know that a 15-person company does not operate the same infrastructure as a 1,500-person one. What they want to see is that you identified the risk and have a defensible response.
The Honest Roadmap Answer
When you genuinely do not have a compensating control, say so and say what you plan to do about it:
Two rules for roadmap answers: name a timeframe that is real, and limit them to three or four per questionnaire. More than that and the pattern reads as “we have not started yet” rather than “we are building this systematically.”
What Never to Do
Never answer “yes” to a control you do not have. Procurement teams cross-check answers against your SOC 2 report, your security page, and sometimes against the answers you gave them last year. A false “yes” that surfaces later does not create a follow-up question — it creates a trust event that can disqualify the vendor relationship entirely.
Likewise, do not leave a question blank and hope it is not noticed. It will be. A blank row on a scored questionnaire is a zero, and a zero with no explanation lands in the risk committee summary.
The Document Stack That Makes This Faster
If you are staring at your first questionnaire and most of the answers are “we have not written that down yet,” the root problem is not the questionnaire — it is that your policies and controls are not documented. Every questionnaire you fill out from here will ask the same categories of questions: password policy, encryption posture, incident response procedures, employee training, data handling practices.
Writing those policies once, before the next questionnaire arrives, means the bulk of your answers become citations rather than compositions. A Risk Assessment Report, a Password & Access Control Policy, a Data Handling & Privacy Policy, an Incident Response Plan, and a Compliance Checklist cover the majority of what any standard questionnaire asks.
That is the real leverage: the second questionnaire takes a fraction of the time the first one did, because the answers already exist. The third takes even less. Having a compliance framework in place does not just help you pass audits — it makes every inbound security assessment faster and more consistent.
A Repeatable Process for the Next One
Once you have answered your first questionnaire, set up a process so the next one does not start from zero:
- Save a master answer library. A spreadsheet with your canonical answer to each common question category. Update it whenever a policy changes.
- Note every compensating control and roadmap answer you gave. When the roadmap item ships, update the master library. When a customer sends a follow-up questionnaire a year later, you want the answer to reflect your current state.
- Track which customers asked. If three customers ask the same question and you cannot answer it, that is a signal about which control to implement next.
This is what turns a reactive scramble into a routine operation. The first questionnaire is always painful. The goal is to make sure that pain pays forward.
When You Are Assessing Your Vendors Instead
Everything above is about answering a questionnaire you received — the inbound side. If you need to build a process for assessing your own vendors (the outbound side), we wrote a separate guide: Vendor Risk Assessments for Startups: A Tiered Approach Auditors Actually Accept. The two processes are complementary — a company that does both well has vendor risk covered from both directions.
The hardest part of answering a vendor security questionnaire is not the questionnaire — it is realizing you need to write the policies first. VylintShield generates a Risk Assessment Report, Data Handling & Privacy Policy, Incident Response Plan, and Compliance Checklist — the documents most questionnaire answers cite — so the next time a customer sends you a spreadsheet, you already have somewhere to point.
Related: assessing your own vendors and which framework to start with.