A SOC 2 security questionnaire review is the buyer’s way of checking your controls in detail, and a SOC 2 report can answer many of those questions with independent evidence instead of self-reported answers. It will not replace every questionnaire, but it makes most of them faster to complete.
What are SIG and CAIQ?
SIG and CAIQ are standardized security questionnaires used in third-party risk management. The SIG (Standardized Information Gathering) is published by Shared Assessments, and the CAIQ (Consensus Assessments Initiative Questionnaire) is published by the Cloud Security Alliance.
| Questionnaire | Publisher | What it is |
|---|---|---|
| SIG | Shared Assessments | A shared question bank buyers use for vendor risk assessment, with Lite and Core tiers (per a secondary summary). |
| CAIQ | Cloud Security Alliance | Yes/No questions on controls in IaaS, PaaS and SaaS services, built around the Cloud Controls Matrix. |
| Custom questionnaire | The buyer | A list the customer writes itself, often adapted from these. |
The CSA says the CAIQ offers an industry-accepted way to document what security controls exist in cloud services. A completed SIG is not a certification; it records your claimed controls, and the buyer’s reviewers decide what to follow up. SIG tier details here come from a secondary summary, so confirm them with Shared Assessments.
Which questionnaire answers can a SOC 2 report support?
A SOC 2 report supports answers about controls the examination covered: access, change management, monitoring, incident response, vendor management and, if included, availability, confidentiality and privacy. It does not cover anything outside the report’s scope or period.
| Typical questionnaire topic | How a SOC 2 report helps |
|---|---|
| Access control and MFA | Logical access controls tested by the CPA firm |
| Change management | Tested controls over production changes |
| Logging and monitoring | Tested monitoring and alerting controls |
| Incident response | Tested incident procedures |
| Vendor risk | Subservice organization treatment and vendor controls |
| Business continuity | Availability controls, if that category is in scope |
Questions on topics outside the report, such as physical security of an office not in scope or specific technical settings, still need direct answers. See SOC 2 control examples for what the report usually covers.
How do you answer a questionnaire faster with SOC 2?
Answer faster by building a reusable answer library and pointing to the report where it applies. A consistent library cuts repeated work and avoids contradictory answers across customers.
- Share the current SOC 2 report under NDA before the questionnaire arrives, and ask whether the buyer will accept it in place of overlapping sections.
- Keep one master answer set, with an owner and a review date.
- Cite report sections or control names in answers rather than rewriting them.
- Flag items outside the report’s scope honestly instead of stretching it.
Compliance tools can store the answer library; see compliance automation tools. Keep the report current: how to read a SOC 2 report shows what buyers check first.
When does a questionnaire still come first?
A questionnaire still comes first when a buyer’s process requires it regardless of reports, or when you do not have a report yet. It can also be used for lower-risk vendors where a full report is not requested.
- No report yet: a questionnaire is the fallback, and it can show what a SOC 2 would need to cover.
- Standard buyer process: some buyers send it to every vendor, then compare against the report.
- Regulated buyers: banks and similar buyers may ask for both; see bank vendor SOC reports.
If questionnaires are slowing every deal, that is a signal to scope a report; SOC 2 for startups covers how to decide.
What should a trust page or customer pack include?
A simple customer pack saves reviewers’ time. Include the items most buyers ask for first and keep them current.
- The latest SOC 2 report, shared under NDA, and a bridge letter if needed.
- A short security overview and architecture summary.
- Pre-filled SIG or CAIQ answers you keep up to date.
- Policies you can share, and a named security contact.
- A SOC 3 report if you want a public summary.
Next Assurance helps you scope a report that answers the questions buyers keep asking. See our SOC 2 audit service.
Frequently asked questions about SOC 2 and security questionnaires
Does a SOC 2 report replace a security questionnaire?
Sometimes partly. Many buyers accept a SOC 2 report in place of overlapping questionnaire sections, but some still require their own form. Ask early whether the report will be accepted. Items outside the report’s scope, or newer than its period, still need direct answers from you.
What is the SIG questionnaire?
The SIG, or Standardized Information Gathering questionnaire, is published by Shared Assessments and used by buyers for third-party risk assessment. According to a secondary summary it comes in tiers such as Lite and Core, and a completed SIG records your claimed controls rather than certifying them. Confirm current details with Shared Assessments.
What is the CAIQ?
The Consensus Assessments Initiative Questionnaire is a set of Yes/No questions from the Cloud Security Alliance that documents what security controls exist in IaaS, PaaS and SaaS services. Version 3.1, released April 1, 2020, is marked no longer accepted by the STAR Registry, and CSA directs users to version 4, combined with the Cloud Controls Matrix.
Can we reuse the same answers for every customer?
Mostly. Keep a master answer set with an owner and review date, then adapt only the parts a buyer asks differently. Reuse saves time but must stay accurate: update answers when controls change, and never copy an answer that no longer matches the SOC 2 report or your actual practice.
Why do buyers still send questionnaires if we have SOC 2?
Because their process may require a standard form for every vendor, because your report may not cover their specific concerns, or because it is dated. A questionnaire fills gaps. Offering the report first and a concise gap-focused answer set usually shortens the review.
Should we publish a trust page?
It helps. A trust page can summarize your security program, link a SOC 3 report if you have one, and explain how customers request the SOC 2 under NDA. It cuts early questions, but it should not overstate: keep it consistent with the report and update it when the report period changes.
Sources
Facts checked against the sources below on October 7, 2026. SIG details come from a secondary summary because the Shared Assessments site could not be opened in this review.
- Cloud Security Alliance – Consensus Assessments Initiative Questionnaire v3.1: purpose, version status and relation to the Cloud Controls Matrix.
- ComplyDog – What is a SIG questionnaire?: secondary summary of the SIG published by Shared Assessments.
- AICPA & CIMA – System and Organization Controls: SOC Suite of Services: the AICPA’s overview of SOC 1, SOC 2 and SOC 3 reports.
- AICPA & CIMA – 2017 Trust Services Criteria (With Revised Points of Focus – 2022): the criteria a SOC 2 examination evaluates.
