Security Questionnaires: What They Mean for Your Organization

Security questionnaires are how organizations check the security of the companies they work with. A hospital checks its billing service. A manufacturer checks its IT provider. A university checks a software vendor. An insurer checks a business before it offers cyber coverage.

The questions come in a few common forms:

• Standard formats. Recognized questionnaires published by industry groups, so one set of answers can be reused across many customers.
• Custom customer questionnaires. A customer’s own list, often built from a standard format or a framework.
• Insurer applications. Cyber insurance applications, renewal forms and supplemental questionnaires, often focused on MFA, backups, email security and incident response.
• Contract security exhibits. Security requirements written into a contract, sometimes with a questionnaire attached.

What does this cover, and what doesn’t it?

It covers: the common questionnaire formats, how to answer honestly, what evidence to keep, how the topics in our other guides map to typical questions, and where ALCON DTS can help.

It is not:

• An audit or a certification. A completed questionnaire is your own statement about your controls. It is not an independent audit.
• Something your IT provider signs for you. You attest to your answers. ALCON DTS can help gather evidence and draft technical answers, and you decide what to submit.
• Legal or insurance advice. Questions about contract terms, coverage or the effect of an answer belong with your attorney or broker.

You will likely see security questionnaires if:

1. You sell services to larger organizations. Health systems, manufacturers, financial firms, universities and government contractors commonly assess their vendors.
2. You buy or renew cyber insurance. Applications and renewals ask about your controls.
3. You handle regulated information for someone else. A business associate under HIPAA or a defense supplier handling controlled unclassified information will be asked how that information is protected.

Quick check: does this apply to you?

• A customer, partner or insurer has sent you security questions in the last year, or you expect them at your next renewal or contract.
• Your answers affect a sale, a contract or your insurance.

If both are true, this very likely applies to you. If a questionnaire is tied to a contract or an insurance policy, confirm with your attorney or broker what signing it means for you.

The common formats

A few details worth knowing:

• SIG. Shared Assessments describes SIG Lite as a foundation of questions for lower-risk third parties and SIG Core as a comprehensive set for service providers that pose higher risk. Assessors can also mix in more detailed questions from the SIG content library for specific domains. In March 2026, Shared Assessments launched a web-based version of the SIG alongside the familiar spreadsheet.
• CAIQ. The Cloud Security Alliance describes the CAIQ as a set of “yes/no” questions to assess security controls. Both version 4.0 and 4.1 are accepted for its public registry until December 2027. If you are not a cloud service provider, you may still receive a CAIQ from a customer who uses it as a general template.
• HECVAT. EDUCAUSE says HECVAT 4 added questions on privacy and AI. Vendors may use it with their college and university customers at no cost.

How do you answer honestly?

• Answer what is true today. A control you plan to add next quarter is a “no” or “in progress” today. Say when it is planned.
• Use the comment field. “Partially” with a short explanation is better than a “yes” that is only true for some systems. Name the scope: which users, which systems, which locations.
• Mention compensating controls, not excuses. If you don’t do exactly what is asked, explain what you do instead and why.
• Keep answers consistent. Different customers will ask the same question in different words. Keep one answer library so your answers match.
• Know who signs. The person who signs is attesting for the organization. Make sure they have read the answers.
• Don’t guess. If you don’t know, find out. A wrong “yes” can cause more trouble than an honest “no.”

Why accuracy matters on insurance applications

Insurers generally rely on the answers in your application when they decide whether to offer coverage and on what terms. If an answer turns out to be inaccurate, it can create problems later, including when you make a claim. How that works depends on your policy language and the law that applies, so this is a question for your broker and your attorney, not your IT provider. Read every question carefully, answer for the whole organization, and tell your broker if something changes before the policy starts.

What evidence should you keep?

Keep a dated evidence file that backs up your answers. Common items include:

• MFA registration and enforcement reports, and your sign-in policies
• A list of administrator accounts and when they were last reviewed
• Device inventory and encryption status
• Backup settings and records of restore tests
• Email authentication settings and filtering
• Logging and monitoring settings, and examples of alerts handled
• Written policies: acceptable use, access control, incident response, and your acceptable AI use rules
• Security awareness training completion records
• Your latest risk analysis or framework assessment, with the work plan
• Business associate agreements and vendor contracts, where they apply
• A copy of each questionnaire you submitted, with the date and who signed

How the other guides map to typical questions

You keep the compliance decisions. We run the controls. You keep the attestation: you review, sign and submit every questionnaire, and ALCON DTS does not attest for you. What we can do is make sure the technical answers come from the live environment, not from memory.

Questionnaire help is included in Secure IT. The exact controls behind your answers depend on your ALCON DTS plan and any project work. ALCON DTS does not provide legal or insurance advice, does not certify compliance, and does not sign or submit questionnaires on your behalf.

• HIPAA. Customers that are covered entities often send questionnaires before signing a business associate agreement. Your answers should match your security risk analysis (45 CFR 164.308(a)(1)(ii)(A)) and your agreement.
• CMMC and NIST SP 800-171. Defense customers may ask about your status. Answer based on your actual assessment results and plan, and see our CMMC guide for DoD suppliers.
• Texas Cybersecurity Safe Harbor (SB 2610). A documented program that conforms to a recognized framework (Bus. and Com. Code Sec. 542.004) also gives you a consistent basis for questionnaire answers. See Texas SB 2610 Cybersecurity Safe Harbor.
• Contracts. Some customers attach your answers to the contract or require you to tell them if something changes. Read those terms with your attorney.
• Insurance. Your application may become part of your policy. Review it with your broker before you sign.

• SIG Questionnaire and SIG FAQ (Shared Assessments)
• Cloud Controls Matrix and CAIQ v4.1 (Cloud Security Alliance)
• CCM v4.1 Transition Timeline (Cloud Security Alliance)
• Higher Education Community Vendor Assessment Toolkit (EDUCAUSE)
• HECVAT 4: Better than Ever (EDUCAUSE Review)
• 45 CFR 164.308, Administrative safeguards (eCFR)
• Texas Business and Commerce Code, Chapter 542, Cybersecurity Program (Texas Constitution and Statutes)

Last reviewed: September 30, 2026

This page is general information about security questionnaires, not legal or insurance advice for your situation.