Which questionnaires do we handle?
Every major standardized questionnaire has its own structure, terminology, and audience. We know what each one is trying to find out.
- SIG (Standardized Information Gathering): published by Shared Assessments to assess third-party risk across security, privacy, and business resilience. Requesters usually send SIG Lite, SIG Core, or a version built from the full question library.
- CAIQ and CCM: the Cloud Security Alliance's Consensus Assessments Initiative Questionnaire asks cloud providers how they meet the Cloud Controls Matrix. A completed CAIQ can also be published to the CSA STAR Registry as a self-assessment.
- HECVAT: the Higher Education Community Vendor Assessment Toolkit from EDUCAUSE, used by colleges and universities to assess vendors that handle institutional data. We work with whichever version the institution sends.
- VSA questionnaires: the Vendor Security Alliance's VSA Full covers security practices in depth, and VSA Core focuses on the most critical security and privacy questions.
- Custom questionnaires: spreadsheets and portals created by individual customers, often with their own terminology.
How we answer custom vendor questionnaires
Custom questionnaires are the hardest because they do not follow a standard. Customers use them for risk assessment, contract oversight, and due diligence, and each one emphasizes different things.
We read each question for what the reviewer is really trying to learn, prioritize the complex ones, and answer clearly and consistently with your other responses. Where a control is missing, we do not paper over it: we recommend a fix or a compensating control and describe your actual position honestly.
What happened to Privacy Shield?
The EU-U.S. Privacy Shield was invalidated by the Court of Justice of the European Union in July 2020 in the Schrems II decision, so questionnaires should no longer ask you to rely on it. Its replacement is the EU-U.S. Data Privacy Framework (DPF), which the European Commission recognized as adequate in July 2023, with a UK Extension and a Swiss-U.S. framework alongside it.
We help you answer DPF-related questions accurately, prepare for self-certification with the U.S. Department of Commerce if it suits your business, and explain the transfer mechanisms you use instead, such as Standard Contractual Clauses. We can also review how you protect both employee and customer data.
Answer once, reuse often
Most questionnaires ask similar questions in different words. We build a reviewed library of approved answers and supporting evidence, so your next questionnaire takes far less effort and your answers stay consistent across customers.
