Questionnaire types
Security questionnaire
A list of questions a customer sends a supplier to judge whether the supplier can be trusted with its data and systems. Anything from thirty questions in a form to several hundred across many spreadsheet tabs.
Vendor security assessment (VSA)
The customer-side process the questionnaire is part of: the questionnaire, the evidence review, a risk rating and a decision. Some customers use "VSA" for the questionnaire itself.
SIG
The Standardized Information Gathering questionnaire from Shared Assessments, the standard used by banks, insurers and large enterprises. SIG Core is the full set; SIG Lite is the short version. See SIG vs CAIQ vs DDQ.
CAIQ
The Consensus Assessment Initiative Questionnaire from the Cloud Security Alliance, built for cloud services and mapped to the Cloud Controls Matrix.
DDQ
A due diligence questionnaire: broader than security, covering the company, its finances, insurance and continuity as well as its security controls.
RFP security section
The security questions inside a request for proposal. Usually a shortened questionnaire, answered under a deadline set by the sales cycle rather than the security team.
Answering
Answer library
The set of approved answers, one per fact, that questionnaires are answered from. Kept with an owner and a date on each entry. See building an answer library.
Knowledge base
In Responsemate, the answer library plus the documents, links and past questionnaires the AI answers from.
Evidence
A document that shows an answer is true: a policy, a certificate, a test report, an exercise log. See what evidence to attach.
Not applicable
An honest answer when a question describes something you do not do or do not have, with a sentence saying why. Reviewers accept it when the reason is real.
Confidence score
In Responsemate, a High, Medium or Low mark on each drafted answer, with the reasons: how squarely the sources answer the question, how well they match it, and how fresh they are.
Source
Where a drafted answer came from: the Q&A entry, file, link or earlier answer it was built from. An answer with its sources can be checked; one without is an opinion.
Freshness
Whether a source or answer is still current: a certificate before its expiry date, a policy reviewed within the year, a headcount from this quarter.
Approve
The step where a person accountable for the answer confirms it. A draft becomes an answer only when someone approves it.
Frameworks and standards
ISO 27001
The international standard for an information security management system. Certification means an auditor checked that the system exists and works, within a defined scope. See ISO 27001 questionnaires.
SOC 2
An attestation report, issued by an auditor under the AICPA's trust services criteria, on a service organisation's controls. Type I describes the controls at a point in time; Type II tests them over a period. See SOC 2 questionnaires.
ISAE 3000 and ISAE 3402
International assurance standards used for auditor reports on a service organisation's controls, common in Europe where SOC 2 is less used. See ISAE 3000 questionnaires.
NIS2
The EU directive on the security of network and information systems, in force through national law since 2024, which makes covered organisations responsible for the security of their suppliers. See NIS2 supplier questionnaires.
DORA
The EU Digital Operational Resilience Act for the financial sector, applying from 2025, with detailed requirements on how financial entities manage their ICT third parties. See DORA questionnaires.
GDPR
The EU General Data Protection Regulation. In a questionnaire it appears as questions about personal data, lawful basis, processors and sub-processors, transfers, and breach notification. See GDPR vendor assessments.
NIST CSF
The US National Institute of Standards and Technology's Cybersecurity Framework: five functions (identify, protect, detect, respond, recover) many questionnaires are organised around.
Cyber Essentials
A UK government-backed certification of five basic controls. Often asked for by UK public bodies and their suppliers.
Control
A specific measure that reduces a risk: quarterly access reviews, encryption at rest, a tested backup. Frameworks are lists of controls; questionnaires ask whether you have them.
Control mapping
Linking your answers and evidence to the controls of a framework, so you can see which controls you cover, which you do not, and answer a framework-based questionnaire from what you already have.
Contracts and privacy
Data processing agreement (DPA)
The contract under GDPR between a customer (controller) and a supplier (processor) that sets out how personal data is handled. Questionnaires ask whether you have one and often ask for it.
Sub-processor
A supplier your supplier uses to process the customer's data: the hosting provider, the e-mail service, the AI provider. Customers expect a published list and notice of changes.
Data residency
Where data is stored and processed geographically. "EU data residency" means the data does not leave EU data centres.
Trust center
A public page where a company publishes its security posture, certificates and policies for customers to read before they ask. It answers common questions in advance; it does not answer a customer's own questionnaire. See Responsemate vs. a trust center.
Penetration test
A test in which security specialists try to break into a system and report what they found. Questionnaires ask when the last one was, its scope and whether the findings were fixed.
Recovery point and recovery time objectives (RPO, RTO)
How much data you could lose in an outage (the time since the last usable backup) and how long the service could be down. Questionnaires on business continuity ask for both.