What it is
CAIQ and SIG questionnaires are two standard security questionnaires that buyers send to suppliers. The CAIQ comes from the Cloud Security Alliance. The SIG comes from the Shared Assessments Program. Both exist for the same reason: a customer that reviews many vendors does not want to invent new questions each time, and you do not want to write new answers each time.
The CAIQ, short for Consensus Assessments Initiative Questionnaire, is built on the Cloud Controls Matrix. That matrix groups controls into domains: audit and assurance, application security, business continuity, change control, cryptography, data security, identity and access, infrastructure security, logging, incident management, supply chain, threat and vulnerability management. Each question carries a control ID such as IAM-04. You answer Yes, No or Not Applicable, then add a scope note or justification. Version 4 lines up with CCM version 4, so questions and controls share numbering.
The SIG, short for Standardized Information Gathering, is a broader business and IT risk questionnaire. It comes in tiers: SIG Lite for a quick first look, a standard SIG Core, and a deeper version for high risk vendors, plus add-on modules for topics such as privacy and cloud. It asks about governance, risk management, asset management, access control, physical security, HR security, operations, incident response, resilience, privacy and third-party oversight. Most answers are yes, no or not applicable, with a comment box and room for evidence.
Both arrive as a spreadsheet or a web form. Neither is an audit. They record what you say about your own program.
How it works
The flow is similar for both. A prospect or an existing customer sends the file during procurement or an annual vendor review, usually with a one or two week deadline. Someone fills in the answers, attaches policies, screenshots, reports or diagrams as evidence, and returns it. The buyer scores it, flags red items and may book a call with your security lead.
Scope beats any single answer. If you host customer data in a multi-tenant product, say so at the top. If a subprocessor runs part of the service, describe the function rather than naming confidential details. A clear scope statement kills half the follow-up questions before they arrive.
CAIQ answers can be published in the CSA STAR registry. Level 1 is a self assessment where you submit your completed CAIQ. Higher levels involve independent review. Publishing saves time with buyers who check the registry first, and it makes your answers public, so they need to be accurate.
SIG responses usually stay private between you and the buyer. Many teams keep a master SIG file and a master CAIQ file, then work from a copy per customer. Log the version you sent, the date and who approved it.
Why it matters for a business
These questionnaires sit in the sales path. A deal waits until the security review closes, so slow answers cost pipeline. A ready response with evidence turns a two week back and forth into a few days.
They also force you to write down how your controls work. That is the same material a SOC 2 audit or an ISO 27001 assessment asks for. A completed CAIQ gives you a control list, owners and evidence, which is most of the scoping work.
Finance and operations leads care because answers create commitments. If you say access is reviewed quarterly, someone has to do it quarterly. Statements in a questionnaire often end up in a contract as security obligations, so answer for the process you run, not the one you plan to run.
Common mistakes
Marking a control Not Applicable because it feels inconvenient is the fastest way to lose trust. Buyers compare answers across vendors, and they know which controls a SaaS company should have.
Copying another company's file shows. The wording drifts from your own policies, the screenshots show someone else's console, and one follow-up call exposes it. The same goes for claiming a control works when it sits on a roadmap. Say it is planned, and give a date and an owner.
Answers often live in one person's inbox. When that person leaves, nobody can explain what you told a customer two years ago. Keep the library and the evidence in a shared, versioned place.
Watch the evidence itself. Attaching a penetration test report or a SOC 2 report with another customer's name on it creates a breach. Redact before you send. Treating SIG Lite like the deeper version wastes days on questions the buyer never asked.
How to get started
Ask the buyer which file and which version they want, then work from that exact template. Versions change numbering, and a merged or edited file creates rework.
Name one owner for questionnaires. Build a question to control map, so each answer points at a policy, a system setting or a report. Store answers with the evidence in a shared folder: access reviews, change tickets, incident logs, backup restore tests, training records. Review the draft with the engineer or IT lead who runs each control before it goes out.
Put a refresh on the calendar, once a year and after any big change such as a new cloud region, a new subprocessor or a merger. Keep a short log of what you sent and when.
If you want outside help, the SOC 2 readiness assessment from Cloudverg is $7,500/month, fixed scope over three weeks, and it gives you a gap assessment, a policy and evidence inventory and a remediation roadmap. That inventory is the same raw material CAIQ and SIG answers are built from. It is one option among others, alongside mapping the controls in house or buying a governance tool.
Frequently asked questions
Is the CAIQ the same as the SIG?
No. The CAIQ comes from the Cloud Security Alliance and follows the Cloud Controls Matrix, so it leans toward cloud controls and control IDs. The SIG comes from Shared Assessments and covers business and IT risk more broadly, in tiers. They overlap on access control, incident response and continuity, but the structure and wording differ.
Do I have to answer every CAIQ question?
You should answer nearly all of them. Not Applicable is a valid answer when a control truly does not apply, but it needs a short reason. A blank cell reads as a gap and usually triggers a follow-up question.
Can I reuse SIG answers for a CAIQ?
Only partly. Map your existing answers to the CAIQ control IDs and rewrite them to match that wording. Pasting SIG text into a CAIQ file leaves answers attached to the wrong control, and reviewers notice the mismatch quickly.