Who sends the security questionnaire?

It comes from the buyer's security, IT, or third-party risk function rather than the business sponsor. The sponsor typically initiates the review internally, but the questions and the timeline belong to the risk team.

Does a SOC 2 report replace a security questionnaire?

Usually it shortens the questionnaire rather than removing it. A SOC 2 Type II report lets a reviewer skip collecting evidence for controls the audit already covers, but the buyer still has to map the vendor's controls against its own policy, and scope differences mean gaps remain.

What is the difference between a security questionnaire and a vendor risk assessment?

The questionnaire is one input to the assessment. The broader assessment also draws on audit reports, contract terms, architecture review, and the buyer's own classification of how sensitive the data involved is.

What is a security questionnaire? A practical definition

Glossary · enterprise · 4 min read · last verified 2026-07-21

Reviewed before publication Editorial board Independent commercial review

In shortA security questionnaire is a structured set of questions a prospective customer sends a vendor to assess how it handles data and risk before a contract is signed.

A security questionnaire is a structured set of questions a prospective customer sends a vendor to assess how that vendor stores data, controls access, and manages risk before a contract is signed. It is issued by the buyer's security, IT, or third-party risk function rather than by the business sponsor who wants the product, and clearing it is a condition of purchase in most enterprise organizations.

What a security questionnaire is

The questionnaire is the working document of a vendor risk review. Its form varies, but the categories are consistent across organizations:

Data handling — what data the vendor collects, where it is stored, how long it is retained, and how it is deleted
Encryption — protection of data in transit and at rest, and how keys are managed
Access control — authentication requirements, privileged access, and how employee access is granted and revoked
Subprocessors — which fourth parties touch customer data, and under what terms
Incident response — detection, notification timelines, and past breach history
Business continuity — backup, recovery objectives, and tested failover
Secure development — code review, dependency scanning, and penetration testing cadence
Personnel — background checks, security training, and offboarding

Some buyers write their own. Many use standardized instruments instead: the Standardized Information Gathering (SIG) questionnaire from Shared Assessments, the Consensus Assessments Initiative Questionnaire (CAIQ) published by the Cloud Security Alliance, or a questionnaire derived from a framework the buyer already follows. Standardized formats are easier to answer repeatedly but are not shorter — SIG in particular exists in multiple scoped versions.

Why security questionnaires matter

The questionnaire is the most common hidden gate in enterprise deals. It does not appear on a sales pipeline as a stage, it has no owner on the vendor side by default, and the reviewer on the buyer side has no revenue incentive and no deadline. Three consequences follow.

It arrives late. Most questionnaires are triggered after commercial terms are agreed, which is exactly when a forecast has hardened around a close date.
It moves at the reviewer's pace. Security review queues are shared across every vendor the organization is evaluating, and a request that sits in a queue is invisible to the sponsor pushing for it.
It can reopen settled questions. A finding about data location or subprocessors can send the deal back to legal, and occasionally back to architecture.

A deal that stalls here rarely ends in a loss to a named competitor. It ends in a slipped quarter or a no-decision loss — the opportunity closes without anyone choosing anything.

How security questionnaires work

The sequence is predictable even when the content is not:

Trigger. The sponsor requests a vendor review, or procurement opens one automatically once a spend or data-sensitivity threshold is crossed.
Scoping. The buyer decides which tier the vendor falls into. A tool touching regulated customer data draws a far longer review than one that does not.
Response. The vendor answers, usually alongside supporting artifacts — an audit report, an architecture diagram, a penetration test summary, a subprocessor list.
Follow-up. The reviewer returns clarifying questions. This round is where most elapsed time is lost, because each exchange restarts a queue wait.
Findings and disposition. Gaps are classified. Some are blocking, some require a compensating control, some are noted and accepted.
Risk acceptance. A business owner signs off on residual risk. Security teams usually recommend; they less often hold the final decision.

Common misconceptions

It is paperwork. It is an approval stage with a named owner, an internal SLA, and the authority to stop a signature. Treating it as administrative overhead is what makes it expensive.
An audit report replaces it. A SOC 2 Type II report or an ISO 27001 certificate usually shortens the questionnaire and lets the reviewer skip evidence collection. It rarely eliminates the review, because the buyer still has to map the vendor's controls to its own policy.
The security team decides. They assess and advise. Whether residual risk is acceptable is normally a business judgment made by the sponsor's leadership.
Longer answers are safer. Volunteering detail outside the question's scope generates follow-ups and, occasionally, new findings.
Every buyer asks the same thing. Regulated industries, public-sector buyers, and companies operating under multiple regimes each ask different questions and weight them differently.

Security questionnaires in practice

Vendors who move through this stage quickly treat it as a repeatable process rather than a series of one-off fire drills:

Maintain an answer library. Keep reviewed, current answers to the recurring questions, with the owning team and last-reviewed date attached. Stale answers are worse than missing ones.
Ask for the questionnaire early. Requesting it during evaluation, not after pricing is agreed, converts a late blocker into parallel work.
Identify the reviewer by name. The sponsor often does not know who holds the queue. Finding out is the difference between a two-week and a two-month cycle.
Track it as a stage with a date. An untracked review has no aging, so nobody escalates.
Separate blocking findings from advisory ones. Negotiating everything at once wastes the credibility needed for the item that actually matters.
Write compensating controls down. When a control is absent, describing what mitigates the risk gives the reviewer something to accept. Silence gives them nothing.

The questionnaire is where a buying group's risk function exercises its veto. Mapping it alongside the rest of the buying committee — and understanding what the sponsor will be asked to defend internally — turns the most common late-stage surprise into a scheduled step. It belongs in the same category as the other questions buyers ask before switching: predictable, answerable, and costly only when it arrives unprepared for.