Vendor Risk Management Security Questionnaires: SIG, CAIQ, & CIS Controls

A security questionnaire is a set of technical questions to assess an organization’s security and compliance posture. In the context of a vendor risk management (VRM) program, questionnaires are a great tool to determine whether a third-party vendor can be trusted with access to the network, and ultimately, whether to do business with them or not.

Your company is probably working with dozens or hundreds of third party vendors managing all kinds of outsourced processes. However, their access to your network can increase the risk of suffering a third-party data breach if not properly monitored. 

Requesting third parties to respond to security questionnaires is considered a cybersecurity best practice across most industries today. It helps you collect the data you need to perform thorough vendor risk assessments and make informed decisions.

How can you begin using security questionnaires? You can:

• Use industry standard questionnaires created by a trusted entity
• Use industry questionnaires as a model and tailor them based on your organization’s needs and use cases
• Create your own custom questionnaire from scratch 

The most commonly used questionnaires in vendor risk management programs include SIG Core and SIG Lite, CAIQ, CAIQ Lite and CIS Controls. You can integrate them into your overall VRM program with a dedicated tool like Bitsight VRM.

Using Security Questionnaires in Bitsight VRM

Bitsight VRM is a tool that automates the end-to-end vendor management process —from due diligence to reassessment and ongoing monitoring. It provides the ultimate risk dashboard to gain visibility over your supply chain and metrics to quantify risk. 

Our platform supports all of the most commonly used security questionnaires, so you can easily integrate them into your VRM process:

Consensus Assessments Initiative Questionnaire (CAIQ)

The CAIQ provides a set of Yes/No questions for cloud service providers, such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) offerings, to determine if their cloud practices are reliably secure.

Bitsight VRM includes access to CAIQ v4. It has a reduced number of questions aligned with the Cloud Controls Matrix (CCM) v4, a cybersecurity control framework for cloud computing that is considered the de-facto standard for cloud security and privacy. CCM v4 incorporated additional controls and improved language that favors the implementation and evaluation of the controls.

CIS Controls

The assessments formerly known as the SANS Critical Security Controls (SANS Top 20) and the CIS Critical Security Controls, were recently consolidated and are now officially called the CIS Controls. After a revision of terminology and grouping of safeguards, the number of controls was reduced from 20 to 18.

Bitsight VRM includes access to CIS Controls V8, the latest version, introducing control renaming and consolidation.

Standardized Information Gathering Questionnaire (SIG Core & SIG Lite)

The SIG Questionnaire evaluates vendors based on 18 individual risk controls to define how they manage security risks. It is updated every year, reflecting new security and privacy challenges.

Bitsight VRM includes access to SIG Lite and SIG Core, 2022 and 2023 versions. The latest version introduced a new Environmental, Social, and Governance (ESG) domain and a new Nth-Party Management domain. In addition, the Security Policy domain was removed, and its content was relocated to the Nth-Party Management and Information Assurance domains.

Why You Need Security Questionnaires In Your Vendor Risk Assessments

Industry questionnaires are a great tool to assess vendor risk through objective validation criteria, but they shouldn't be your only method. You can complement them with other artifacts, such as:

• Certifications, including SOC reports, ISO 27001, or HiTrust.
• Attestations, including penetration tests, application scans, or insurance documentation.
• Industry-specific standards, including HIPAA for organizations handling healthcare data, PCI DSS for organizations handling credit card data, or NERC CIP for critical infrastructures in the electricity sector.
• Security ratings and analytics, including privacy, security, financial, and geographical risk rating scores.

The Bitsight VRM platform allows you to set up all these questionnaires and artifacts as part of your vendor risk assessment lifecycle, both for due diligence and as part of your periodic reassessments and continuous monitoring. This increases trust across your digital supply chain by ensuring your vendors are in compliance with agreed security standards.