Folio 3Questionnaires · SIG, CAIQ, HECVAT, VSA
SIG vs CAIQ, and the other security questionnaires
The standard question sets that vendor risk assessments are built from: who publishes each, how big it is, what it costs, and how the SIG’s 21 risk domains line up with the CAIQ’s Cloud Controls Matrix, NIST CSF 2.0 and ISO 27001.
The SIG, from Shared Assessments, is a paid questionnaire updated every year, with 128 questions in SIG Lite, 627 in SIG Core and 1,936 in the full library (2025 edition). The CAIQ, from the Cloud Security Alliance, is free for internal use and has 283 yes/no questions in v4.1. Send the CAIQ to cloud providers; the SIG to everyone else. 11 products in this register ship the SIG and 6 the CAIQ.
The four questionnaires side by side
| Questionnaire | Publisher | Current version | Size | Cost | Usually sent to |
|---|---|---|---|---|---|
| SIG | Shared Assessments | 2026 SIG (2027 release announced Oct 2026) | Lite 128 · Core 627 · Detail 1,936 questions (2025 edition), 21 risk domains | Paid: $7,000 a year, corporate licence, or membership | Any third party, any industry; the default for financial services |
| CAIQ | Cloud Security Alliance | v4.1 (January 2026), on CCM v4.1 | 283 yes/no questions over 17 domains and 207 controls | Free for internal use; a licence to build it into a product | Cloud and SaaS providers; published to the CSA STAR registry |
| HECVAT | EDUCAUSE | 4.1.6 (HECVAT 4) | One workbook (Full, Lite and On-Prem merged in HECVAT 4); no count published | Free to colleges, universities and their vendors | Vendors selling to higher education |
| VSA | Vendor Security Alliance | VSA-Full and VSA-Core (latest named edition 2019) | No count published | Free, behind a registration form | Vendor security, with US and EU privacy in VSA-Core |
Counts as each publisher states them. Shared Assessments has not published counts for its 2026 or 2027 releases; the 2025 figures are the latest. Checked November 8, 2026.
The SIG: three depths, 21 domains
The Standardized Information Gathering questionnaire is the oldest shared question set in third-party risk, published by Shared Assessments and revised every year. It comes as an Excel workbook (SIG Manager) and, since 2026, as a hosted version, SIG EV.
- SIG Lite, 128 questions: Broad, higher-level understanding of a third party's internal information security controls; for vendors needing basic due diligence or as a preliminary assessment.
- SIG Core, 627 questions: For third parties that store or manage highly sensitive or regulated information; a deeper level of understanding of how a third party secures information and services.
- SIG Detail, 1,936 questions: The full Content Library question set; detail-level questions are not included in Standard SIG questionnaires and are used for customised or deep-dive assessments.
It is licensed: a corporate licence is listed at $7,000 a year, and the SIG is included in every Shared Assessments membership. Questions can’t be edited without permission, but up to 100 custom questions can be added. Shared Assessments says the content is mapped to 33 regulations, frameworks and guidance documents, among them ISO 27001:2022, NIST CSF 2.0, DORA, NIS2, the interagency guidance, NYDFS Part 500 and the CAIQ itself. Source.
Its companion for checking answers is the Standardized Control Assessment (SCA): procedures for verifying the SIG’s answers on site or remotely, mirroring the same 21 domains, listed at $1,500 / 1 Year, Corporate License (multi-year pricing via sales).
Who publishes it: in 2021, OneTrust, which also sells TPRM software, agreed to acquire Shared Assessments and said it would remain a vendor-neutral organisation. The SIG is built into many competing products (table below).
The 21 SIG risk domains
- Access Control
- Application Management
- Artificial Intelligence (AI)
- Asset and Information Management
- Cloud Services
- Compliance Management
- Cybersecurity Incident Management
- Endpoint Security
- Enterprise Risk Management
- Environmental, Social, Governance (ESG)
- Human Resources Security
- Information Assurance
- IT Operations Management
- Network Security
- Nth Party Management
- Operational Resilience
- Physical and Environmental Security
- Privacy Management
- Server Security
- Supply Chain Risk Management (SCRM)
- Threat Management
As listed on Shared Assessments’ SIG pages. They sit in four control areas: governance and risk, information protection, IT operations and resilience, and incident and threat management.
The CAIQ and the Cloud Controls Matrix
The CAIQ turns the Cloud Security Alliance’s Cloud Controls Matrix into 283 yes/no questions (version 4.1, released January 2026). CCM v4.1 has 207 controls in 17 domains; v4.0 had 197. CSA accepts v4.0 and v4.1 CAIQs on its registry until December 2027 and withdraws v4.0 in January 2028. A shorter CAIQ-Lite exists for lighter reviews.
It is free to download and use inside your organisation; building it into a product needs a CSA licence. Its advantage is publication: a provider can post its completed CAIQ to the STAR registry, so a buyer can read it before sending anything. On November 8, 2026 the registry listed 2,704 CAIQs, 69 CAIQ-Lites and 416 Level 2 (audited) entries.
The 17 CCM domains
- A&A
- Audit & Assurance
- AIS
- Application & Interface Security
- BCR
- Business Continuity Management and Operational Resilience
- CCC
- Change Control & Configuration Management
- CEK
- Cryptography, Encryption, & Key Management
- DCS
- Datacenter Security
- DSP
- Data Security & Privacy
- GRC
- Governance, Risk Management, & Compliance
- HRS
- Human Resources Security
- IAM
- Identity & Access Management
- IPY
- Interoperability & Portability
- IVS
- Infrastructure & Virtualization Security
- LOG
- Logging & Monitoring
- SEF
- Sec. Incident Mgmt, E-Disc & Cloud Forensics
- STA
- Supply Chain Management, Transparency, and Accountability
- TVM
- Threat & Vulnerability Management
- UEM
- Universal Endpoint Management
Mapping the SIG to the CAIQ, NIST CSF and ISO 27001
Which Cloud Controls Matrix domain, NIST CSF 2.0 category and ISO 27001 Annex A controls cover the same subject as each SIG risk domain. Use it to accept a vendor’s CAIQ in place of SIG sections, or to see where a SIG answer lands in your own framework.
| SIG risk domain | CCM v4 (CAIQ) | NIST CSF 2.0 | ISO 27001:2022 Annex A | Note |
|---|---|---|---|---|
| Access Control | IAM | Protect: PR.AA (Identity Management, Authentication, and Access Control) | Organisational (5.15 Access Control, 5.18 Access Rights); Technological (e.g. 8.5 Secure Authentication) | |
| Application Management | AIS | Protect: PR.PS (Platform Security; PR.PS-06 secure software development) | Technological (8.25 Secure Development Life Cycle, 8.28 Secure Coding) | SCA lists this domain as 'Application Security'. |
| Artificial Intelligence (AI) | — | — | — | No CCM v4.x domain or CSF 2.0 category is AI-specific. CSA covers AI in a separate AI Controls Matrix (AICM), and ISO covers it in ISO/IEC 42001 (which SIG maps to), not in 27001 Annex A. |
| Asset and Information Management | DSP | Identify: ID.AM (Asset Management); Protect: PR.DS (Data Security) | Organisational (5.9 Inventory of Information and Other Associated Assets, 5.12 Classification of Information) | DSP covers the data side only. Where CCM places physical asset cataloguing was not verified, so no second code is given. |
| Cloud Services | IVS, IPY | — | Organisational (5.23 Information Security for Use of Cloud Services) | The whole CCM is cloud-specific, so IVS/IPY are only the closest single-domain subject matches. SCA lists this domain as 'Cloud Hosting Services'. No CSF 2.0 category is cloud-specific. |
| Compliance Management | A&A, GRC | Govern: GV.OC (GV.OC-03 legal, regulatory, and contractual requirements), GV.PO (Policy) | Organisational (5.31 Legal, Statutory, Regulatory and Contractual Requirements, 5.36 Compliance With Policies, Rules and Standards for Information Security) | |
| Cybersecurity Incident Management | SEF | Respond: RS.MA, RS.AN, RS.CO, RS.MI; Detect: DE.AE | Organisational (5.24–5.28, incident management planning through collection of evidence); People (6.8 Information Security Event Reporting) | |
| Endpoint Security | UEM | Protect: PR.PS (Platform Security) | Technological (8.1 User Endpoint Devices, 8.7 Protection Against Malware) | |
| Enterprise Risk Management | GRC | Govern: GV.RM (Risk Management Strategy); Identify: ID.RA (Risk Assessment) | — | ISO 27001 handles risk assessment and treatment in main-body clauses (6.1, 8.2, 8.3), not as an Annex A theme. |
| Environmental, Social, Governance (ESG) | — | — | — | Out of scope of CCM, CSF 2.0 and ISO 27001 Annex A. Shared Assessments also sells a separate ESG SIG. |
| Human Resources Security | HRS | Govern: GV.RR (GV.RR-04 cybersecurity is included in human resources practices); Protect: PR.AT (Awareness and Training) | People (6.1–6.8, e.g. 6.1 Screening, 6.3 Information Security Awareness, Education, and Training) | |
| Information Assurance | — | — | — | Left empty on purpose. The SIG's scope for this domain is defined only in the registration-gated Guide To Risk Domains, so no confident subject match is possible. |
| IT Operations Management | CCC | Protect: PR.PS (PR.PS-01 configuration management practices) | Organisational (5.37 Documented Operating Procedures); Technological (8.9 Configuration Management, 8.32 Change Management) | Logging/monitoring (CCM LOG, CSF DE.CM) may also sit here depending on SIG scoping. Not asserted. |
| Network Security | IVS | Protect: PR.IR (PR.IR-01 networks and environments are protected from unauthorized logical access and usage); Detect: DE.CM (DE.CM-01 networks monitored) | Technological (8.20 Network Security, 8.21 Security of Network Services, 8.22 Segregation of Networks) | In CCM, network security sits within Infrastructure & Virtualization Security. |
| Nth Party Management | STA | Govern: GV.SC (Cybersecurity Supply Chain Risk Management) | Organisational (5.19–5.22, especially 5.21 Managing Information Security in the ICT Supply Chain) | Fourth- and nth-party (subcontractor) oversight. |
| Operational Resilience | BCR | Recover: RC.RP (Incident Recovery Plan Execution); Protect: PR.IR (PR.IR-03 resilience mechanisms) | Organisational (5.29 Information Security During Disruption, 5.30 ICT Readiness for Business Continuity); Technological (8.13 Information Backup, 8.14 Redundancy of Information Processing Facilities) | |
| Physical and Environmental Security | DCS | Protect: PR.AA (PR.AA-06 physical access to assets is managed, monitored, and enforced); Detect: DE.CM (DE.CM-02 physical environment monitored) | Physical (7.1–7.14) | |
| Privacy Management | DSP | — | Organisational (5.34 Privacy and Protection of PII) | CSF 2.0 does not cover privacy as a category. NIST's separate Privacy Framework does, and the SIG maps to it. |
| Server Security | IVS | Protect: PR.PS (Platform Security) | Technological (8.8 Management of Technical Vulnerabilities, 8.9 Configuration Management) | Server/OS hardening. Closest CCM subject is Infrastructure & Virtualization Security. |
| Supply Chain Risk Management (SCRM) | STA | Govern: GV.SC (GV.SC-01 to GV.SC-10) | Organisational (5.19–5.23 supplier relationship controls) | |
| Threat Management | TVM | Identify: ID.RA (ID.RA-01 vulnerabilities, ID.RA-02 threat intelligence, ID.RA-03 threats); Detect: DE.CM | Organisational (5.7 Threat Intelligence); Technological (8.7 Protection Against Malware, 8.8 Management of Technical Vulnerabilities) |
This is our mapping, by subject, not an official crosswalk. It matches domain and category titles only; a dash means no confident match. Shared Assessments ships question-level mappings to the CAIQ, CCM, CSF and ISO inside the licensed SIG, and CSA publishes CCM mappings to other standards with the CCM download.
Download the mapping as CSV (21 rows, CC BY 4.0).
HECVAT and VSA
HECVAT
The Higher Education Community Vendor Assessment Toolkit, from EDUCAUSE with Internet2 and REN-ISAC. Version 4.1.6 (HECVAT 4) (HECVAT 4) folds the old Full, Lite and On-Prem versions into one workbook, and adds privacy and AI questions. It is free to colleges, universities and their vendors; TPRM platforms need EDUCAUSE’s permission to build it in. Vendors are expected to update theirs at least once a year.
VSA questionnaires
The Vendor Security Alliance, a non-profit coalition, issues two free questionnaires: VSA-Full, on vendor security in depth, and VSA-Core, the most critical security questions plus US and EU privacy. The latest editions named on its site are from 2019. Members can also commission VSA audits.
Asked for a penetration test report?
Nearly every questionnaire asks the vendor for a recent penetration test of its application, usually from the last 12 months and with retest results. If you're the vendor and don't have one, these AI-driven options publish a price for testing one web application and its APIs, and what they say about retests is shown. Ordered by published entry price; checked November 8, 2026.
| Provider | Offer | Published price | Retests | Review |
|---|---|---|---|---|
| Decima SystemsFeatured firm · promotional pick | Starter (early access) · Pilot | $99 a month (Starter, 1 target, monthly AI-run assessment) · $3,000 one-off (Pilot) | Starter: automated retest after a fix. Pilot: one agreed retest | A person reviews confirmed critical and high findings (Starter); reviewed findings (Pilot) |
| Astra Security | Pentest Auto | $2,999 a year, 1 target | One human re-scan by experts to verify fixes | Autonomous, with expert re-scan |
| Pentest-Tools.com | AI Pentest (Specter) | $3,000 per application, one-off | Two free retests | Autonomous; audit-ready PDF report within 24 hours |
| Cobalt | Autonomous Pentest | $3,500 per web app test (limited-time price, to Dec 31, 2026) | Not stated for this offer | Directed by a Cobalt Core pentester |
| Intruder | Same-day AI pentest | $3,500 per test | Unlimited retesting | AI-powered, built by CREST-certified experts |
| Aikido Security | Standard Pentest | $4,000 per assessment (one app and its primary APIs) | Free re-testing for up to 6 months | AI pentest; no high or critical finding, no charge |
Prices are what each provider publishes, not like-for-like quotes; scope and review differ. Decima Systems is the featured firm on this site, a promotional pick.
Which TPRM tools ship which questionnaires
From the 32 products in the register: the standard question sets each vendor says its library includes. A product that doesn’t name one may still support it on request.
| Product | SIG | CAIQ | HECVAT | Others named |
|---|---|---|---|---|
| Venminder | SIG Core, SIG Lite | CAIQ | — | — |
| Censinet RiskOps | — | — | — | NIST CSF |
| Prevalent | SIG | CAIQ | — | ISO 27001, NIST CSF, NIST SP 800-53, NIST 800-171 / CMMC, PCI DSS |
| Risk Ledger | — | — | — | ISO 27001, NIST CSF |
| SecurityScorecard | SIG | CAIQ | — | — |
| UpGuard | SIG | — | — | DORA, HIPAA |
| Panorays | SIG | CAIQ | — | NIST CSF, ISO 27001, DORA, PCI DSS |
| Bitsight | SIG Lite | — | HECVAT | NIST CSF, ISO 27001, NIST 800-171 / CMMC |
| Black Kite | SIG | — | — | — |
| LogicGate Risk Cloud | SIG | CAIQ | — | — |
| OneTrust | SIG Core, SIG Lite | — | — | — |
| Supplier Shield | — | — | — | ISO 27001, SOC 2, NIST CSF, NIST SP 800-53, PCI DSS, NIST 800-171 / CMMC |
| VISO TRUST | SIG | — | — | SOC 2, ISO 27001, NIST CSF, PCI DSS |
| Whistic | SIG | CAIQ | — | — |
| Zania | — | — | — | SOC 2, ISO 27001, PCI DSS |
11 products name the SIG, 6 the CAIQ and 1 the HECVAT. 17 products name none; most of those are security-ratings services, which don’t send questionnaires.
Questions
What is the SIG questionnaire?
The Standardized Information Gathering questionnaire, published by Shared Assessments and updated every year. It asks a third party about its controls across 21 risk domains, in three depths: SIG Lite (128 questions in the 2025 edition), SIG Core (627) and SIG Detail, the full library of 1,936. It is licensed, not free.
What is the difference between SIG Lite and SIG Core?
Size and depth. Shared Assessments describes SIG Lite as a broad, higher-level view for basic due diligence or a first pass, and SIG Core as the deeper set for third parties that store or manage highly sensitive or regulated information. In the 2025 edition that was 128 questions against 627.
What is the CAIQ?
The Consensus Assessment Initiative Questionnaire from the Cloud Security Alliance: 283 yes/no questions in version 4.1 (January 2026), each tied to a control in the Cloud Controls Matrix. Cloud providers fill it in and can publish it on the CSA STAR registry, which listed 2,704 CAIQs on November 8, 2026.
Is the SIG free?
No. Shared Assessments lists a corporate licence at $7,000 a year, and the SIG is included with its memberships. Many TPRM platforms license it and include it in their questionnaire library, so a buyer of one of those platforms may not need a separate licence; ask the vendor.
SIG or CAIQ: which should we send?
Send the CAIQ to cloud and SaaS providers, especially those that already publish one on the STAR registry: you can read it before asking for anything. Send the SIG (Lite for low-risk vendors, Core for critical ones) when the third party is not mainly a cloud service, or when your regulator expects the SIG’s coverage of areas such as privacy, operational resilience and nth parties. Many vendors will offer a SOC 2 report instead; it answers different questions, not fewer.
Need a tool that runs these for you?
Tell us which questionnaires you send and how many vendors get them. We reply with the products in this register that ship them. We only pass your details to a vendor if you ask us to.
Sources for this page
- Shared Assessments: the SIG (archived product page, April 2026) — The SIG’s tiers, 21 risk domains, licence price, mappings and yearly updates. Live pages now need a sign-in.
- Shared Assessments: 2025 SIG release notes (archived) — Question counts: Lite, Core and Detail.
- Shared Assessments: Product Release 2027 announcement — That a 2027 release was announced in October 2026.
- Cloud Security Alliance: Cloud Controls Matrix v4.1 — CCM v4.1 and CAIQ v4.1: controls, domains, release date, question count.
- Cloud Security Alliance: Cloud Controls Matrix (research page) — The 17 domains, the licence terms for internal use.
- Cloud Security Alliance: CCM v4.1 transition timeline — v4.0 accepted for STAR until December 2027, withdrawn January 2028.
- CSA STAR Registry — Published CAIQ counts, read on November 8, 2026.
- EDUCAUSE: HECVAT — HECVAT 4 version, structure and cost.
- Vendor Security Alliance — VSA-Full and VSA-Core, cost and editions.
- Shared Assessments: SCA (archived) — What the Standardized Control Assessment is, and its price.
Each product’s own sources are linked from its entry in the register. How products are chosen and ordered, and how to correct an entry: methodology.
Cite this page
Third-Party Risk Management Software. “SIG, CAIQ and the other vendor security questionnaires.” Updated November 8, 2026. https://thirdpartyriskmanagementsoftware.com/security-questionnaires/