The questionnaire is a technical review wearing a procurement costume
Most companies treat the vendor security questionnaire as an administrative step owned by whoever has the least to do that week. That framing costs deals. The questionnaire is the last technical review your product gets before a signature, conducted by people who will never speak to your engineers, using only the words you put in the cells. A reviewer who cannot tell from your answer whether customer data crosses a tenant boundary does not call to ask. They mark it as a finding, route it to a security architect, and your close date moves a quarter.
The pattern is consistent across the buyers who send these. A hospital system, a state agency, a ratings firm regulated by the SEC, a prime contractor flowing down a defense clause, and a bank running SR 11-7 model risk governance all send different documents that ask substantially the same twelve things. The vocabulary differs. The underlying question does not: where does our data go, who can reach it, what happens when you are breached, and can you prove any of this without asking us to trust you.
What follows is what those documents contain, which answers stall, and where the real work sits. The questionnaire is downstream of your architecture. You cannot write your way out of a design that puts customer data in a shared index.
The four documents you will actually receive
Four formats cover most enterprise and public-sector requests, and knowing which one arrived tells you who is reading it.
The Shared Assessments SIG is the heavyweight, maintained as a licensed content library and shipped in a full version running well past a thousand questions and a Lite version in the low hundreds. It is organized by risk control area and is what you get from financial services, insurance, and large health systems with mature third-party risk programs. The Cloud Security Alliance CAIQ maps to the Cloud Controls Matrix and is roughly 260 yes/no questions with a compensating-control column. It is the standard ask for a hosted offering and the CSA STAR registry lets you publish a completed one publicly, which is the single most effective thing a software company can do to shorten this cycle.
The HECVAT covers higher education, which matters to anyone selling research software. The agency or prime custom sheet is the least predictable: usually a spreadsheet built by pasting control families out of NIST SP 800-53 or SP 800-171, containing several questions that make no sense for your product alongside four that are genuinely load-bearing.
A fifth category is growing fast enough to name separately: the AI addendum. Twenty to sixty questions bolted onto whatever the buyer already used, asking about training data provenance, whether customer data is used to improve models, which foundation model providers sit in the path, prompt injection defenses, human review of consequential output, and increasingly whether the vendor maintains an AI management system under ISO/IEC 42001 or has mapped its practices to the NIST AI Risk Management Framework.
What actually stalls a security review, by how long it holds the deal
Editorial ranking of how far each issue typically pushes a close date, from practitioner reading of enterprise and public-sector reviews. An ordering of effect, not a measured statistic.
Tenancy is the question underneath a third of the sheet
Read a SIG or a CAIQ carefully and you find one architectural question asked six or eight ways. Is data logically separated. Is encryption keyed per customer. Can an operator query across customers. Are logs commingled. Is there a path by which one tenant's content reaches another tenant's session.
Those are not six questions. They are one question, and it was answered when someone chose a schema. A single database with a tenant_id column is a defensible design that a reviewer will accept if you can describe the enforcement layer and show how it is tested. The same design with enforcement in application code that a developer can forget to call is the finding that ends the review.
The version of this that kills AI deals is the vector store. A retrieval system that embeds every customer's documents into one index and filters at query time by metadata has put all customers one filter bug away from each other. Reviewers have learned to ask about this specifically. The compensating answer is not a policy. It is a per-tenant index or a per-tenant collection with the isolation enforced at the storage layer, plus a test in continuous integration that queries as tenant A and asserts nothing from tenant B comes back. That test is a screenshot you can attach. It closes the question in one exchange instead of five.
Every yes needs an artifact behind it
The most expensive habit in questionnaire response is answering yes because the thing is broadly true. Yes, we encrypt data at rest. Yes, we do background checks. Yes, we have an incident response plan. A reviewer processing forty vendors a quarter has learned that unsupported affirmatives correlate with findings, so a page of clean yeses without references triggers an evidence request that adds three weeks.
Answer instead in the form of claim plus artifact plus scope. Encryption at rest is AES-256 through the managed key service, keys rotated annually, and here is the configuration export. Background checks are run by a named provider on all personnel with production access, covering criminal and employment history, and here is the policy document with its revision date. Incident response is documented in a plan last exercised in a tabletop on a specific date, and here is the after-action summary with customer names removed.
The artifacts do not have to be audit reports. A configuration export, a policy PDF with a version history, a redacted penetration test summary, an architecture diagram with trust boundaries drawn, an access review screenshot, and a subprocessor list with locations answer most of what a mid-market reviewer asks. Build that folder once and the second questionnaire costs a fifth of the first.
Where the AI questions are going
The AI section is the part of the questionnaire most likely to be written by someone who is not certain what they are asking, which makes precise answers unusually valuable. Six themes recur.
| What they ask | What they are worried about | What a strong answer contains |
|---|---|---|
| Is our data used to train your models | Their content becoming another customer's output, and a contractual promise they made downstream | A flat no with the mechanism: training data sources named, a contractual no-training term with the model provider quoted, and where fine-tuning happens if it happens at all |
| Which model providers are in the path | An undisclosed subprocessor and a data-residency claim that quietly breaks | Every provider named, the region each call lands in, retention terms, and whether a self-hosted path exists |
| How do you handle prompt injection | Untrusted content in the context window reaching a tool that can act | The trust boundary described: what content is untrusted, which tools are reachable from a model turn, what requires human confirmation. Mapping to the OWASP LLM Top 10 by item number reads as fluent |
| What governance framework do you follow | Whether anyone owns AI risk internally | NIST AI RMF functions mapped to real practices, or an ISO/IEC 42001 management system, with named owners rather than a committee |
| How do you evaluate and monitor the model | Silent degradation nobody catches | An evaluation set, the metrics gated in the release process, drift monitoring in production, and the threshold that triggers a rollback |
| Where does a human review output | An automated decision with consequences and no appeal path | The decision classes that require review, who reviews, the override rate, and the audit record that makes a decision reconstructable |
Two reference points are worth naming because reviewers recognize them. The OWASP Top 10 for LLM Applications gives shared vocabulary for prompt injection, insecure output handling, excessive agency, and supply chain exposure. MITRE ATLAS catalogs adversarial techniques against machine learning systems the way ATT&CK does for enterprise networks. Citing them by item shows you engaged the threat model rather than a checklist.
For anyone selling into banks, insurers, or firms with a model risk function, the older reference still governs. SR 11-7, the Federal Reserve and OCC supervisory guidance on model risk management, has been in force since 2011 and its three pillars, development soundness, independent validation, and governance with clear ownership, are being applied to machine learning systems whether or not the vendor thinks of its product as a model. If your buyer's second line of defense uses that language, the questionnaire is really asking whether your documentation can survive an independent validation your customer will run without you.
The federal flow-down that arrives without warning
A company selling to a prime contractor, a federally funded research center, or a state agency spending federal money will eventually receive clauses that were not in the sales conversation. The most common is NIST SP 800-171, which applies where the buyer will send you controlled unclassified information. It is 110 security requirements in fourteen families, and in defense contracts it reaches you through DFARS 252.204-7012 along with a 72-hour cyber incident reporting obligation and a media preservation duty.
The practical shape is a self-assessment producing a score under the DoD Assessment Methodology, a system security plan describing how each requirement is met, and a plan of action for the rest. The score runs from 110 down, points deducted by requirement weight, and a negative score is common and not fatal on its own. What matters to the buyer is the plan and the dates.
Two design decisions carry most of the cost here, and both are architecture rather than paperwork. First, scope. If controlled information can reach any laptop, any mailbox, and any backup set, then your entire company is in the assessment boundary. A segmented environment with named users, its own identity path, and no route to the general corporate estate is the difference between a project measured in months and one measured in years. Second, the cloud. If regulated content lands in a hosted service, DFARS 252.204-7012 requires that provider to meet the FedRAMP Moderate baseline or an equivalent your firm ends up defending. Choosing a service already listed in the FedRAMP marketplace removes that argument entirely, and it is the cheapest decision available if you make it before you build.
How much review time each piece of prepared evidence removes
Editorial weighting of which prepared artifacts shorten a review most, from practitioner reading. Illustrative of relative effect, not a measured statistic.
The contradiction problem
The failure that embarrasses companies most is not a bad answer. It is three good answers that disagree. Sales says data stays in region. Engineering says the analytics pipeline replicates to a second region for cost reasons. The privacy notice on the website lists a subprocessor the questionnaire response left out. A reviewer who finds one contradiction stops trusting the document and starts verifying everything in it, which converts a two-week review into a two-month one.
This is an ownership problem with a mechanical fix. Keep one answer library, versioned, with a named owner per section who is the person who would know: infrastructure owns hosting and encryption, engineering owns application security and isolation, whoever runs the AI systems owns the AI section, legal owns contracts and breach terms. Every response is assembled from that library rather than written fresh. When an answer changes, it changes once. The library is also what makes a questionnaire a two-day task instead of a two-week fire.
Check the library against your public surface twice a year. Your privacy policy, trust page, terms, AI marketing claims, and questionnaire answers should say the same thing about the same facts. A published claim your engineering cannot support is a durable artifact in your own archive, discoverable long after the deal closes.
What a certification does and does not buy
Buyers ask for SOC 2 Type II and ISO 27001 because they are shorthand for an independent party having looked. They are worth having and frequently misread by the people who ask for them. A SOC 2 report covers a defined system boundary over a defined observation window against the trust services criteria the auditor and the company selected. It does not certify that a product feature is secure, and the exceptions section is where the information lives.
What a certification buys is the removal of an argument, not the removal of the questionnaire. A buyer with a mature program will still send the sheet, but the reviewer accepts more answers by reference, and the evidence requests drop sharply. Budget for it accordingly: a first SOC 2 Type II is commonly a six to twelve month calendar exercise once the readiness work is counted, with audit fees frequently landing in the $30,000 to $60,000 range for a small company and the internal engineering time costing more than the auditor does.
ISO/IEC 42001 is the new entry, an AI management system standard published at the end of 2023 and now appearing in AI addenda. It is early enough that having it is a differentiator and not having it is not yet disqualifying. If your buyers are regulated and AI is central to what you sell, mapping your practices to it now is cheaper than certifying under deadline later.
Answering the question you were actually asked
Reviewers are not adversaries. They are risk professionals with a queue, and the vendors they remember are the ones who made the job possible. Three habits do that.
Say no cleanly when the answer is no. A no with a compensating control and a date reads as competent. A yes that unravels under evidence review reads as something worse, and it follows you into the next renewal. If a control is not implemented, write what is implemented instead, what risk that leaves, and when the gap closes. Reviewers accept gaps with plans constantly. They do not accept discovering a gap you described as closed.
Answer the scope, not the word. When a question asks whether you perform annual penetration testing, the useful answer names who performed it, what was in scope, when it concluded, and how findings were tracked to closure. The one-word answer generates a follow-up that costs both sides a week.
And write for a person who cannot see your system. The reviewer has your answer and nothing else. Name the boundary, name the data, name the mechanism, name the artifact. Every sentence that would leave a stranger uncertain about where data sits is a sentence that will come back as a question.
Bottom line
The questionnaire is not the obstacle. It is the visible surface of design decisions made when nobody was thinking about procurement: how tenants are separated, where data lands, which providers sit in the path, whether anything is tested rather than asserted. Companies that treat it as a writing exercise answer the same findings on every deal. Companies that treat it as an engineering requirement build the isolation, the evidence folder, and the answer library once, and the review stops deciding their close dates.
If you are building a system that will be sold into regulated buyers, the cheapest time to solve this is before the architecture is set. The second cheapest is now, while the current questionnaire is still open.
Frequently asked questions
Two to twelve weeks depending on the buyer's maturity and how much prepared evidence you have. The long tail is almost always evidence requests generated by unsupported answers, not the initial questionnaire itself.
Not always, but the absence gets substituted with a longer questionnaire and more evidence requests. Some buyers will accept a Type I plus a dated plan for Type II, and many mid-market buyers accept a well-documented control set with artifacts.
The SIG is Shared Assessments' licensed question library organized by risk control area, common in financial services and health care. The CAIQ maps to the Cloud Security Alliance Cloud Controls Matrix and is aimed at hosted offerings. A completed CAIQ can be published on the CSA STAR registry, which pre-answers many requests.
Whether customer data is used for training, which model providers sit in the request path and in what region, and how tenant isolation is enforced in retrieval systems. All three are architecture answers, not policy answers.
It applies when a buyer sends you controlled unclassified information, which reaches commercial firms through prime contract flow-downs, federally funded research agreements, and state contracts spending federal money. The scoping decision, how much of your estate can touch that data, drives most of the cost.