CAIQ, HECVAT and SIG: the security questionnaires small SaaS teams get
Most security questionnaires are the customer’s own spreadsheet. Three are standard and come up again and again: the Cloud Security Alliance’s CAIQ, EDUCAUSE’s HECVAT and Shared Assessments’ SIG. Here is what each one is, who sends it, how long it is, and how Policyseed handles it.
| Questionnaire | Who sends it | Length | Answers | In Policyseed |
|---|---|---|---|---|
| CAIQ v4Cloud Security Alliance (CSA) | Enterprise customers of cloud and SaaS providers; also the self-assessment for the CSA STAR Registry | 261 questions in v4.0.x, 283 in v4.1.0, across 17 domains | Yes / No / NA, control ownership, optional implementation description | Recognized: answers written into its own columns |
| HECVAT 4EDUCAUSE | Colleges and universities buying software or cloud services | About 320 questions over seven topic sheets; the Start Here sheet marks which ones apply to you | Yes / No / N/A plus Additional Information | Recognized: answers written into its own columns |
| SIG Lite / SIG CoreShared Assessments | Enterprises with a third-party risk management program | Lite is the shorter set; Core is the comprehensive one. Counts change between releases | Set by the release; read the instructions sheet | Generic detection: answers added as new columns |
CAIQ: Consensus Assessments Initiative Questionnaire
The CAIQ is a spreadsheet of yes-or-no questions built on the Cloud Security Alliance’s Cloud Controls Matrix (CCM). Cloud and SaaS providers fill it in to describe the controls in their service, and can submit it to the CSA STAR Registry as a STAR Level 1 self-assessment. Version 4.0 has 261 questions across 17 domains; version 4.1.0 has 283. CSA also publishes a shorter CAIQ-Lite.
Each question has an id such as A&A-01.1. You answer Yes, No or NA, say who owns the control under the shared security responsibility model (your company, the customer, a third party or shared), and can describe how you implement it. Yes means the control is in place, not that a policy requires it.
HECVAT: Higher Education Community Vendor Assessment Toolkit
Colleges and universities send the HECVAT to software and cloud vendors before they buy, and EDUCAUSE maintains it. Version 4 replaced the separate Full, Lite and On-Premise versions with one workbook: the Start Here sheet asks a few questions about your product and marks which questions on the topic sheets (Organization, Product, Infrastructure, IT Accessibility, Case-Specific, AI and Privacy) you need to answer. Each question takes Yes, No or N/A, with Additional Information where the guidance asks for detail. Return it as the original Excel file: the institution’s scoring sheets read your answers.
SIG: Standardized Information Gathering questionnaire
Shared Assessments publishes the SIG for third-party risk management programs. It is sold and licensed by Shared Assessments and released by year. SIG Lite is the shorter set and SIG Core the comprehensive one; your customer sends you the version they licensed.
How Policyseed handles them
The questionnaire tool reads the file you upload in your browser. When it recognizes a CAIQ v4 or HECVAT 4 workbook, it shows the format and question count, drafts an answer to each open question from your Policyseed policies, and writes it back into the workbook’s own columns, keeping its other sheets, formatting and dropdowns:
- CAIQ: Yes, No or NA in the CSP CAIQ Answer column, and the drafted text in CSP Implementation Description. SSRM Control Ownership is left for you.
- HECVAT: Yes, No or N/A in each sheet’s Answer column, and the drafted text in Additional Information. Cells the workbook fills with its own formulas are never touched.
- Never a guessed Yes. The answer cell gets Yes or No only when the draft itself says so, from a matched policy statement or your intake answers. A question your policies do not cover leaves the answer cell empty with a note telling you what to add.
- SIG and anything else: the tool finds the question column and adds Answer, Status and Sources columns next to it.
No questionnaire? The free draft answers cover a standard set of 35 questions, and the vendor security questionnaire template is the one to send your own vendors.
Frequently asked questions
- Can Policyseed give me the CAIQ, HECVAT or SIG questions?
- No. All three are copyrighted by their publishers. Download the CAIQ from the Cloud Security Alliance, get the HECVAT from EDUCAUSE or from the institution that sent it, and use the SIG your customer licensed and sent you. Policyseed only recognizes the layout of the file you upload and writes answers into it.
- Does a Yes in the CAIQ mean the same as a policy?
- No. In the CAIQ, Yes means the part of the control the question covers is implemented. A policy says what you require. Before you send a Yes, check that the practice really runs today, and keep the evidence that shows it.
- We have a SOC 2 report. Do we still need to fill these in?
- Often, yes. Many reviewers still ask for their standard questionnaire, but a current report lets you answer many questions by pointing to it. Without a report, short answers that cite your adopted policies are the honest middle ground; never claim a report or a test you do not have.
- How long does it take?
- It depends on how much of the questionnaire your policies already cover. With the questionnaire tool, one run drafts up to 150 answers; a full CAIQ or HECVAT takes two runs, because questions already answered in the file are skipped the second time. The review, filling in what needs your input, takes longer than the drafting.
Policyseed provides governance policy templates and AI tailoring. It is not legal advice and not a compliance guarantee. Management adopts the policies; the CPA firm performs the SOC 2 examination.