Security Questionnaire Response Template

Buyers send either a standard questionnaire or their own, often as a spreadsheet or through a vendor portal. The Cloud Security Alliance (CSA) publishes the Consensus Assessments Initiative Questionnaire (CAIQ), a set of Yes/No questions a customer may ask a cloud provider¹ about its security controls. Other standard forms include the Shared Assessments SIG and, in higher education, the HECVAT.

If you've published a CAIQ in CSA's public STAR Registry², ask whether the buyer will accept it instead. If not, study their file's layout before you type an answer.

• Which column holds the question ID, and which the question
• How answers are recorded: one column, or a column per choice
• Where explanations go, and any column for the customer's responsibilities
• The declared version, from a header, tab name or filename
• Questions the buyer added after the standard set, which deserve the most care
• Whether the layout holds in the first, middle and last rows

Write down what each answer commits you to, so it means the same thing whoever drafts it. Yes means the control runs today across everything the buyer is buying, not in one environment or on the roadmap. If it covers only part, state the scope or answer No.

No is a legitimate answer. Follow it with what you do instead, or when that will change. N/A needs a reason the control can't apply, such as having no data centers of your own. Never leave a cell blank: it reads as an oversight and brings a follow-up email. And name one person to sign off every answer.

Past answers are the fastest start, but questionnaires change. In January 2026, CSA released version 4.1 of the CAIQ and the Cloud Controls Matrix it is built on. The matrix gained 11 new controls and lost one³, and the CAIQ now has 283 questions. CSA's registry accepts both versions until December 2027³, so buyers may send you either.

Match each new question to your history in this order, and record which method found the match.

1. 1

   Same ID, same version

   Reusable after a quick read, if the facts haven't changed.

2. 2

   Same control, new ID

   Standards renumber between versions. Read both questions in full before reusing.

3. 3

   Similar wording elsewhere

   Another buyer's question is context for the drafter, never a straight copy.

4. 4

   No match

   Leave it unmatched and write a new answer. A forced match gets pasted without being read.

Watch for answers that have since changed. A strong match to last year's Yes is wrong if the control has lapsed. If two past submissions answered the same question differently, settle which is true today before you use either.

Give each answer a sentence or two on how the control works and, where you can, the document behind it. CSA's CAIQ workbook marks its explanation column optional but recommended, and asks for a description "with references"¹ of how you meet each control. Buyers are advised to verify: in its guidance on overseeing service providers, the US Federal Trade Commission says security can't be a "take our word for it" thing⁴.

Before sending, sort every Yes and No into one of four groups and count each, to see how much rests on documents and how much on your word.

Each document an answer names needs its own check. It should be inside its review date, releasable rather than internal, and the right kind: a policy question needs a policy, not a runbook. When the missing document is a written policy, start from the information security policy set template.

Some answers depend on how a system is set up today, on what a supplier's contract says, or on a number nobody measures. Don't guess those. Group them by owner and send each person one note, not a message per question.

In each note, quote the buyer's question exactly, with its ID, and say what you already have and why it falls short. Ask for the fact and any document's name, not customer-ready wording; you'll write that and show them.

Give a date tied to the buyer's deadline and state the fallback. If nobody replies, the answer goes back as No, or as "we can't confirm this in the time available." Track each question's owner, due date and reminders sent. Unassigned questions are the riskiest: nobody is working on them.

Return the buyer's file in its original layout, with nothing renamed or reordered. Keep an untouched copy of their original for when follow-up questions arrive.

Add a one-page cover note. Say what's enclosed, explain groups of N/A answers once, and say how to get each document you cite, including which need a nondisclosure agreement (NDA). If you have a SOC 3 report, attach it. The AICPA calls SOC 3 reports general use reports that can be freely distributed⁵, since they carry less detail than a SOC 2.

Volunteer the gaps a careful reviewer would find anyway, such as an audit period that has ended or a policy marked internal. Raised by you, each is a footnote. Found by the reviewer, it can cast doubt on every other answer.

When the questionnaire comes inside a full bid, the RFP response template covers the rest. The security questionnaire answer tool drafts answers from your SOC 2 report and policies. Or open this template in River, which reads the buyer's file and fills in the sheets.