Security questionnaire answer kit
Received a CAIQ, HECVAT or SIG Lite? Describe your security once and get consistent, ready-to-paste answers for every area, the evidence to attach, and the gaps to close before you send it.
How to answer a security questionnaire quickly
- Find out which one it is. CAIQ, HECVAT and SIG Lite have different lengths and emphasis; a customer’s own spreadsheet usually borrows from them.
- Write your answers once. Keep one approved answer per area and reuse it, so every customer gets the same, consistent story.
- Be precise, not optimistic. A clear "partly, and here is what we do instead" is trusted more than a "yes" you cannot support with evidence.
- Attach evidence. Policies, a SOC 2 or ISO 27001 report, a penetration test summary and screenshots answer follow-up questions before they are asked.
- Close the easy gaps first. MFA for every account, encryption at rest and a tested backup are quick to fix and come up in every questionnaire.
CAIQ, HECVAT and SIG Lite compared
CAIQ Cloud and SaaS customers
From the Cloud Security Alliance, organised by the domains of its Cloud Controls Matrix. Mostly yes/no questions; answers can be published in the CSA STAR registry.
HECVAT Universities and colleges
From EDUCAUSE for vendors to higher education, with detailed questions on student data, authentication and accessibility.
SIG Lite Banks, insurers and large enterprises
From Shared Assessments, common in financial services. The shorter version of the licensed SIG questionnaire, used for lower-risk vendors.
Frequently asked questions
Does this kit contain the official questionnaires?
No. CAIQ, HECVAT and SIG belong to their publishers. The kit drafts your own answers, organised by the areas these questionnaires cover, so you can paste them into the copy your customer sent you.
Can I send the drafted answers as they are?
Review them first. They only restate what you selected, and each customer’s wording differs, so adjust the answer to the exact question and attach the evidence listed.
Are my answers uploaded?
No. The answers are drafted in your browser. If you add your contact details and copy or download, Sourceably saves those details and a short summary, unless you tick "Don’t contact me".
How do I stop answering the same questions again?
Share evidence once: a SOC 2 or ISO 27001 report if you have one, or a verified security scorecard that customers can check, so most questionnaires shrink to the questions specific to them.