Introduction
Enterprise vendor risk programs are not one-size-fits-all. When your customers ask for a security assessment, the type of questionnaire they send tells you a great deal about how they think about their risk, what kind of vendor you are in their eyes, and what they expect to see in your response.
The two most common questionnaires you will encounter in practice are the CAIQ (Consensus Assessments Initiative Questionnaire) and the SIG (Standardised Information Gathering questionnaire). They solve related but distinct problems. Getting them confused leads to wasted effort, missed questions, and frustrated procurement teams.
What Is the CAIQ?
The CAIQ is developed and maintained by the Cloud Security Alliance (CSA). It was specifically designed to help organisations assess the security controls of cloud service providers — SaaS, PaaS, and IaaS vendors. The CAIQ contains approximately 261 questions aligned to the CSA's Cloud Controls Matrix (CCM), which covers 17 cloud-specific security domains.
The CAIQ uses a structured format — in many versions, yes/no questions with supporting commentary — making it relatively quick to complete compared to the SIG. It comes in two primary versions:
• Full CAIQ: 261 questions covering 17 security domains with detailed yes/no responses and evidence references
• CAIQ Lite: A streamlined version with approximately 124 questions, suited for periodic reassessments or lower-risk cloud vendors
Many cloud vendors proactively publish completed CAIQ responses through the CSA's STAR Registry, allowing prospective customers to access and compare security posture without requesting a custom assessment.
What Is the SIG?
The SIG, published by Shared Assessments, takes a broader and deeper approach. While the CAIQ focuses exclusively on cloud environments, the SIG is designed to assess any vendor — cloud or on-premise — across a wide range of security, privacy, operational resilience, and compliance domains.
The SIG covers 19+ risk domains with over 1,200 questions in the full Core version, and maps to more than 35 regulatory frameworks. It is updated annually to reflect evolving threats and compliance requirements. A scoped SIG Lite version reduces this to approximately 150–200 questions for lower-risk vendor engagements.
The Core Difference: Cloud-Specific vs Enterprise-Wide
This is the critical distinction:
• Use CAIQ when assessing a cloud service provider: your SaaS CRM, cloud infrastructure, data storage platform, or any vendor whose services run entirely in the cloud
• Use SIG when assessing any vendor where you need a comprehensive view of risk across their entire operating environment — their people, processes, physical facilities, supply chain, and technology
A marketing automation platform handling your customer email? CAIQ is appropriate. A managed services provider with administrative access to your production systems? SIG Core is warranted.
CAIQ vs SIG: When Each Applies
Use CAIQ When:
• You are assessing a SaaS or cloud-hosted vendor
• You need a standardised, repeatable assessment for a large number of cloud vendors
• The vendor already has a published CAIQ in the CSA STAR Registry
• Speed and efficiency are priorities over depth
• The vendor has limited compliance resources and would struggle with a full SIG
Use SIG When:
• You are assessing a non-cloud vendor, or a vendor with complex on-premise components
• The vendor handles highly sensitive data or has privileged access to your systems
• Your industry requires comprehensive, documented third-party risk assessments (financial services, healthcare, critical infrastructure)
• You need a questionnaire that maps across multiple compliance frameworks simultaneously
• You are a vendor receiving a SIG and need to understand what is being asked of you
As a Vendor: How to Handle Both
If you are on the receiving end of either questionnaire as a vendor, the strategic approach is the same: build a centralised security evidence library that you maintain and update regularly. A well-organised library of policies, certifications, test reports, and control documentation means you can respond to either questionnaire — and most custom assessments — in days rather than weeks.
Organisations that have achieved ISO 27001 certification or completed an SOC 2 audit will find that the heavy lifting for both CAIQ and SIG is already done. The questionnaire becomes an exercise in mapping existing documentation to the specific question format, not building evidence from scratch.
The Bottom Line
CAIQ and SIG are complementary tools, not competitors. Your customers will use whichever is appropriate for the risk level and nature of your vendor relationship. As a vendor, your best strategy is to be prepared for both — and to view security questionnaire completion not as an administrative burden, but as a revenue-protecting activity that keeps you in competitive deals. CyberEagle provides expert-assisted questionnaire completion for both CAIQ and SIG