CAIQ vs SIG: Standardized Security Questionnaires Explained

The CAIQ and the SIG are the two most widely used standardized security questionnaires. Instead of answering every customer's custom spreadsheet, a vendor can complete one of these once and share it with many buyers. This guide explains what each one covers, how they differ, how the CAIQ connects to the CSA STAR registry, and which a small SaaS company should complete first.

Related guides: How to answer and automate security questionnaires · Vendor security questionnaire template · Vendor risk assessment · Best security questionnaire automation software

Key takeaways

• The CAIQ (Consensus Assessments Initiative Questionnaire) comes from the Cloud Security Alliance and focuses on cloud security. It maps to the CSA Cloud Controls Matrix (CCM).
• The SIG (Standardized Information Gathering questionnaire) comes from Shared Assessments and covers third-party risk broadly, beyond cloud.
• Publishing a completed CAIQ in the CSA STAR Registry gives buyers a public self-assessment at no cost.
• For most SaaS companies, a CAIQ plus a SOC 2 report answers the majority of enterprise security reviews.

---

What is the CAIQ?

The Consensus Assessments Initiative Questionnaire is a set of yes or no questions, with room for comments, that a cloud provider answers to describe its security controls. Version 4 is aligned with the Cloud Controls Matrix v4, which organizes 197 control objectives into 17 domains, such as identity and access management, data security and privacy, and supply chain management.

Because the CCM is mapped to ISO 27001, SOC 2, NIST and other frameworks, a completed CAIQ lets buyers see how your controls line up with the standards they care about.

What is the SIG?

The Standardized Information Gathering questionnaire is published by Shared Assessments, a third-party risk management membership organization, and updated each year. It covers around 20 risk domains, including enterprise risk, information security, privacy, business resilience, supply chain, and in recent versions, AI. It comes in two common sizes:

• SIG Lite: a shorter version for lower-risk vendors or an initial screen
• SIG Core: a detailed version for vendors handling sensitive data or critical services

Buyers can also scope the SIG to the domains relevant to a vendor, so the questionnaire you receive may be a tailored subset. The SIG is licensed, so buyers and vendors typically access it through Shared Assessments membership or a tool that includes it.

CAIQ vs SIG at a glance

	CAIQ	SIG
Publisher	Cloud Security Alliance (CSA)	Shared Assessments
Focus	Cloud service security	Broad third-party risk, cloud and non-cloud
Based on	Cloud Controls Matrix (CCM)	Its own control content mapped to many standards
Versions	CAIQ v4 (with CCM v4)	SIG Lite, SIG Core, updated yearly
Access	Free to download	Licensed through Shared Assessments
Public registry	CSA STAR Registry	No public registry
Typical requesters	Cloud buyers, tech companies	Banks, insurers, large enterprises, regulated sectors
Effort for a small SaaS	Moderate	Lite: moderate. Core: high

The CSA STAR Registry

The CSA Security, Trust, Assurance and Risk (STAR) program has levels of assurance:

• STAR Level 1 (self-assessment): you publish your completed CAIQ in the public STAR Registry. Free, and a quick way to show transparency.
• STAR Level 2 (third-party audit): an independent assessment, either STAR Certification (built on ISO 27001) or STAR Attestation (built on SOC 2), adds CCM-specific assurance.

For many startups, a Level 1 entry plus a SOC 2 report is a strong combination that answers most cloud security questions upfront.

Which should you complete first?

1. If you sell cloud software to technology companies: complete the CAIQ, publish it on STAR and in your trust center.
2. If you sell to banks, insurers or large regulated enterprises: expect the SIG. Prepare SIG Lite answers early, since many of these buyers send it during procurement.
3. If you are not sure: start with the CAIQ, because it is free, maps well to SOC 2 and ISO 27001, and many answers carry over to the SIG.

In both cases, keep answers consistent with your SOC 2 report, policies and trust center. Reviewers compare them.

How to complete a CAIQ efficiently

1. Download the current CAIQ from the Cloud Security Alliance.
2. Map your existing controls to the CCM domains. If you have SOC 2 or ISO 27001, use the CSA's published mappings.
3. Answer each question honestly with yes, no or not applicable, and add a short comment pointing to the control or evidence.
4. Review with owners in engineering, IT and legal.
5. Publish on the STAR Registry and in your trust center, and set a yearly review date.

Most small SaaS companies with SOC 2 in place can complete a CAIQ in a few days.

How to answer a SIG efficiently

• Ask the buyer which version and which domains they need. Many accept SIG Lite.
• Reuse your answer library and CAIQ answers where questions overlap.
• Attach your SOC 2 report or ISO 27001 certificate for domains it covers, and say so in the response.
• Mark questions about functions you do not have, such as physical data centers, as not applicable with a short reason.

Standardized questionnaires vs custom ones

Standardized questionnaires save time for both sides, but many buyers still send their own. Offer your completed CAIQ or SIG first and ask whether it can replace or shorten their custom questionnaire. Pair it with a trust center so reviewers can find your SOC 2 report, policies and sub-processor list without waiting for you.

Example CAIQ answers

CCM domain	Sample question	Strong answer
Identity and access management	Is multi-factor authentication required for privileged access?	Yes. All staff sign in through SSO with MFA enforced. Administrators use phishing-resistant keys. See SOC 2 control AC-02.
Cryptography and key management	Is data encrypted at rest?	Yes. Customer data is encrypted with AES-256 using our cloud provider's key management service. Keys rotate yearly.
Logging and monitoring	Are security logs retained and reviewed?	Yes. Logs are centralized, retained for 12 months and alert on defined security events, reviewed by the on-call engineer.
Supply chain management	Do you assess the security of your sub-processors?	Yes. Critical vendors are reviewed before onboarding and yearly, using SOC 2 or ISO 27001 reports.
Business continuity	Are backups tested?	Yes. Daily backups are encrypted and a restore is tested every quarter.

Short, specific answers that point to evidence are far more useful to reviewers than a bare "yes".

Mistakes to avoid

• Answering "yes" to everything. Reviewers spot it, and it damages trust when your SOC 2 report says otherwise.
• Leaving the comment column empty. A one-line explanation often prevents a follow-up question.
• Publishing a CAIQ and never updating it. An answer that was true two years ago may now be wrong.
• Using different wording for the same control in the CAIQ, SIG and custom questionnaires. Keep one answer library.
• Marking whole domains as not applicable without a reason, such as physical security when you rely on a cloud provider. Explain that the provider covers it and that you review its reports.

Other standard questionnaires you may see

Besides the CAIQ and SIG, some sectors use their own formats. Higher education institutions often send the HECVAT, healthcare buyers may use questionnaires aligned with HIPAA or HITRUST, and some large enterprises run assessments through third-party risk platforms with their own question sets. The same answer library and evidence work across all of them, which is why keeping one accurate source of truth matters more than which format arrives first.

How SecureSlate helps

SecureSlate questionnaire automation drafts CAIQ, SIG and custom questionnaire answers from your actual controls and evidence, keeping answers consistent with your SOC 2 and ISO 27001 programs. A trust center shares your completed questionnaires and reports under NDA.

FAQ

What does CAIQ stand for?

Consensus Assessments Initiative Questionnaire. It is published by the Cloud Security Alliance and aligned with its Cloud Controls Matrix.

Is the CAIQ free?

Yes. The CAIQ and the Cloud Controls Matrix can be downloaded free from the Cloud Security Alliance, and STAR Level 1 listing is free.

Is the SIG questionnaire free?

No. The SIG is licensed by Shared Assessments, usually through membership. Buyers who send it to vendors typically hold the license.

What is the difference between SIG Lite and SIG Core?

SIG Lite is a shorter questionnaire for initial or lower-risk assessments. SIG Core is a detailed version for vendors with access to sensitive data or critical services.

Can a SOC 2 report replace a CAIQ or SIG?

Often in part. Many buyers accept a SOC 2 report for most security questions and send a shorter questionnaire for the rest. Ask what they will accept.

How often should a CAIQ be updated?

At least once a year, and whenever significant controls change. Update the STAR Registry entry at the same time.

---

How long does it take to answer a SIG Lite?

For a small SaaS company with SOC 2 in place and a good answer library, usually one to three days of work spread across security, engineering and legal.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory, or professional advice. Requirements vary by framework, industry, and jurisdiction. Consult qualified advisors for your specific obligations.