The SIG
The Standardized Information Gathering questionnaire is maintained by Shared Assessments and is the one banks, insurers and large enterprises send most. It comes in two sizes. The SIG Core is the full library, several hundred questions across around twenty domains: access control, asset management, application security, business resilience, cloud, compliance, data protection, human resources, incident management, network security, physical security, privacy, supplier management, threat management. The SIG Lite is a subset of a hundred or so questions used for lower-risk vendors and first passes.
Questions are yes, no or not applicable, with a comment column. The value is in the comment. A bare yes to "Are access rights reviewed periodically?" tells the reviewer nothing; "Quarterly, by the IT lead, results in the ticketing system" tells them everything.
The CAIQ
The Consensus Assessment Initiative Questionnaire comes from the Cloud Security Alliance and maps to its Cloud Controls Matrix. It is the questionnaire cloud and SaaS providers get, and its structure follows the controls matrix domains: application and interface security, audit assurance, business continuity, change control, data security, encryption and key management, governance, identity and access, infrastructure security, logging and monitoring, supply chain, threat and vulnerability management.
Because it is built for shared responsibility, many rows are answered partly by your hosting provider. The major providers publish their own completed CAIQ; quoting the right row of it is the accepted way to answer those questions, with a sentence on what you do on top.
The DDQ
A due diligence questionnaire is what a customer's procurement or risk team sends before signing, and it is broader than security. Expect sections on the company (ownership, years in business, key people), finances and insurance, legal and regulatory standing, business continuity, data protection and privacy, and then a security section that is usually a shortened SIG or CAIQ. Financial institutions and public bodies send the longest ones. The security section is where your answer library applies; the rest is answered once and changes rarely.
What they share
Roughly two thirds of the security questions in any of the three ask the same things in different words: how you control access, how you protect data at rest and in transit, how you develop and change software, how you find and fix vulnerabilities, how you handle incidents, how you keep the service running, who your suppliers are, and how you train people. The wording differs, the numbering differs, the yes/no/comment format differs. The facts do not.
That is the case for one answer library with one approved answer per fact, written in a neutral voice, from which each questionnaire's rows are drafted. The alternative, a completed SIG here and a completed CAIQ there, drifts within two quarters: the SIG says backups are tested monthly, the CAIQ says quarterly, and a reviewer who has both asks which is true.
How to answer all three from one place
Keep the facts, not the questionnaires. For each control, one approved answer with its owner, its evidence and a date. When a SIG arrives, draft every row from that library, review the ones the library only half covers, and export into the SIG's own file. When the CAIQ arrives, the same library answers it in the CAIQ's words. Knowledge in Responsemate is where that library lives, with the evidence and the date on every entry, and the questions you have never written an answer for show up as the rows the AI cannot draft.
Questions people ask
Do we have to fill in the SIG if the customer sends it?
Usually, yes, but you can send the SIG Lite or your own completed SIG from earlier in the year if the customer accepts it, and many do. Ask before you start; a customer who is happy with your latest completed SIG saves both sides a week.
Is the CAIQ only for cloud providers?
It was written for cloud services, but any SaaS company gets it, because to the customer you are a cloud service. If you host on a major provider, part of the CAIQ describes their controls, and their own published CAIQ is your evidence for those rows.
What is the difference between a DDQ and a security questionnaire?
A DDQ is broader. It asks about the company (ownership, finances, insurance, business continuity) as well as security. The security section of a DDQ is usually a shortened version of a SIG or CAIQ.