Sekorti
SIG vs CAIQ vs VSAQ: the security questionnaires compared.
Three standard formats show up again and again in vendor security reviews. Here is who publishes each one, how they differ and how to answer them without starting from scratch.
At a glance
| SIG | CAIQ | VSAQ | |
|---|---|---|---|
| Full name | Standardized Information Gathering questionnaire | Consensus Assessments Initiative Questionnaire | Vendor Security Assessment Questionnaire |
| Published by | Shared Assessments | Cloud Security Alliance (CSA) | Google (open source) |
| Versions | SIG Core (comprehensive) and SIG Lite (shorter) | CAIQ v4, mapped to the Cloud Controls Matrix v4 | Web-based, adapts questions to answers |
| Answer style | Mostly yes/no with detail | Yes/no with comments per control | Dynamic, branching |
| Typical senders | Financial services and large enterprises | Buyers of cloud and SaaS services | Technology companies |
| Access | Licensed through Shared Assessments | Free from CSA | Free, open source |
SIG (Standardized Information Gathering)
The SIG is maintained by the Shared Assessments Program and updated annually. It covers a broad set of risk domains, from information security and privacy to business resilience and third-party management. Buyers choose between SIG Core for high-risk vendors and SIG Lite for a shorter first-pass assessment. It is common in financial services and other regulated industries.
CAIQ (Consensus Assessments Initiative Questionnaire)
The CAIQ comes from the Cloud Security Alliance and maps to its Cloud Controls Matrix (CCM). Version 4 aligns with CCM v4. Cloud and SaaS providers often publish a completed CAIQ in the CSA STAR registry as a self-assessment, which buyers can review instead of sending their own questionnaire.
VSAQ (Vendor Security Assessment Questionnaire)
VSAQ is an open-source, web-based questionnaire released by Google. Its questions adapt to earlier answers, so vendors only see what applies to them. It has not seen major updates in years, so many teams treat it as a reference format rather than a living standard.
Which one will you get?
You rarely choose: the buyer does. Financial institutions lean towards SIG, cloud buyers towards CAIQ, and many companies send a custom spreadsheet built from pieces of all three. The overlap between them is large, which is why a reusable answer base pays off quickly.
How to answer all three faster
Keep one set of evidence and approved answers, then map each format to it. Sekorti’s security questionnaire automation fills SIG, SIG Lite, CAIQ, VSAQ and custom vendor spreadsheets from your own documents, with a source on every answer, and flags what it cannot verify. For the full process, see how to answer a security questionnaire.
Frequently asked questions
What is the difference between SIG Lite and SIG Core?
SIG Core is the comprehensive version used for high-risk vendors; SIG Lite is a shorter subset for initial or lower-risk assessments.
Is the CAIQ free?
Yes. The Cloud Security Alliance publishes the CAIQ and the Cloud Controls Matrix for free.
Can one set of answers cover SIG, CAIQ and VSAQ?
Largely, yes. The formats overlap heavily, so a maintained answer base mapped to each format covers most questions; the remainder needs format-specific answers.
Create your free Trust Center.
Free forever, no card required. Live in minutes.