Your customer sends a SIG or a CAIQ. Here is how to handle it.
Not every customer writes its own questionnaire. Many buyers use a standard one. The two you will see most are the SIG and the CAIQ. The upside: if you answer them well once, you can often reuse the result.
What the SIG is
The SIG (Standardized Information Gathering) is the standard questionnaire of Shared Assessments, an organisation focused on third-party risk management. The SIG is updated every year and comes in a shorter and a more extensive variant. The customer chooses the variant and the sections it uses, depending on how important your service is to it. The SIG covers much more than IT: privacy, business continuity, HR and your own suppliers, for example.
What the CAIQ is
The CAIQ (Consensus Assessments Initiative Questionnaire) comes from the Cloud Security Alliance and is meant for cloud services. Its yes/no questions map to the Cloud Controls Matrix (CCM), the CSA's security framework. You can publish a completed CAIQ in the CSA STAR Registry; that counts as a self-assessment (level 1), not a certification.
The difference in short
| Feature | SIG and CAIQ |
|---|---|
| Published by | SIG: Shared Assessments · CAIQ: Cloud Security Alliance |
| For whom | SIG: any supplier · CAIQ: mainly cloud services and SaaS |
| Format | SIG: extensive list with variants · CAIQ: yes/no questions with comments |
| Basis | SIG: its own framework, mapped to many standards · CAIQ: Cloud Controls Matrix |
| Public sharing | SIG: not by default · CAIQ: possible via the STAR Registry |
How to answer a standard questionnaire well
- Check the version. Both lists are updated. Answer the version the customer sends, not an old one you still have.
- Explain a “no” or “N/A”. A bare “no” raises questions. Briefly say why, and what you do instead.
- Link every “yes” to evidence. A policy, setting or report. Buyers ask for samples.
- Mind the scope. Answer for the service the customer buys, not your whole company if that differs.
- Make it reusable. A well-completed, current CAIQ or SIG can often be sent proactively to the next customer.
Common mistakes
- Answering everything “yes”, even when a control only partly exists
- Reusing an old version without checking your answers are still true
- Presenting a CAIQ in the STAR Registry as a certificate
How Holdvero helps
We complete the SIG or CAIQ based on your own documentation, with the source for every answer. Where evidence is missing, we write an open item instead of a “yes”. Standard questionnaires are often longer than 150 questions; then it becomes a complex questionnaire with a fixed price from €1,195. To keep your answers current for the next customer, we use Evidence Maintenance.
Frequently asked questions
Is a completed CAIQ a certificate?
No. A CAIQ in the STAR Registry is a self-assessment. A higher level requires independent certification or attestation.
Can I send a previously completed SIG or CAIQ to a new customer?
Often yes, if it is current and the version matches what the customer asks for. Check beforehand that your answers are still true.
Which SIG variant should I complete?
The customer chooses, depending on how important your service is to it. Ask if it is not clear.
How long does it take?
An extensive standard questionnaire easily takes days internally. Most of the work is gathering evidence.
Need help with a SIG or CAIQ?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price