Security questionnaires: what buyers ask, the standard formats, and how B2B SaaS teams answer them.

A security questionnaire is a set of questions a buyer sends a vendor to check how it protects data, controls access, and handles incidents before signing. This guide covers the standard formats, what they ask, including about your marketing website, and how B2B SaaS teams can answer them faster, as of October 2026.

What is a security questionnaire?

A security questionnaire is a structured list of questions that a company sends a vendor to check its security and privacy controls, before a contract and often at renewal. The answers are self-reported, so buyers usually ask for evidence as well, such as a SOC 2 report, an ISO/IEC 27001 certificate, or a penetration test summary.

You will hear it called a vendor security questionnaire, a security assessment questionnaire, a vendor risk assessment questionnaire, or simply a security review. From the buyer's side it is one step in third-party risk management. From your side, as the SaaS vendor, it is a step between a verbal yes and a signed contract.

Buyers don't invent this step. Control 15 of the Center for Internet Security's 18 Critical Security Controls, Service Provider Management, opens with: "Develop a process to evaluate service providers who hold sensitive data." NIST's quick-start guide on supply chain risk, published in October 2024, tells organizations to scale supplier requirements to each supplier's criticality and to require evidence of sound security practices, such as self-attestation, conformance to known standards, certifications, or inspections. A questionnaire is the self-attestation.

An audit report is different. A SOC 2 report is a CPA's examination of a service organization's controls relevant to security, availability, processing integrity, confidentiality, or privacy, and the AICPA notes that "customers and business partners often request" one. The questionnaire asks; the report attests.

Why do buyers send security questionnaires?

Because vendors are a common way in. In Verizon's 2026 Data Breach Investigations Report, released May 19, 2026, breaches with third-party involvement rose 60% from the previous dataset and reached 48% of all breaches. A questionnaire is the buyer's first check that your company will not become the way in.

The report draws on more than 31,000 security incidents, over 22,000 of them confirmed breaches, so the third-party figure is not a niche finding.

For the vendor, a questionnaire is a sales problem as much as a security one. In G2's buyer research published July 22, 2026, based on more than 1,000 B2B software buyers, IT security review was the single biggest source of delay in software purchases. 39% of buyers named it, and so did 50% of enterprise buyers. A questionnaire that sits in someone's inbox for two weeks stalls the deal for two weeks. For the rest of what buyers check before a sales call, see what B2B software buyers need from your website.

What are the standard security questionnaire formats?

Most questionnaires are either an industry standard, such as the Shared Assessments SIG, the Cloud Security Alliance CAIQ, or EDUCAUSE's HECVAT, or the buyer's own list in a spreadsheet or a vendor risk portal. Standard formats let you answer once and reuse the answers, which is why a completed one is worth having before the first enterprise deal.

For most B2B SaaS companies, the CAIQ is the sensible first standard to complete: it is free, built for cloud services, and shareable in public. Shared Assessments updates the SIG at least once a year, so when a buyer sends one, check which version and level they expect before you start. If you sell to higher education, plan for the HECVAT.

How do buyers decide which questionnaire to send?

By risk. Buyers sort vendors by the data they touch and how critical the service is, then match the questionnaire to the tier: a short form for low-risk vendors, and a full questionnaire plus evidence for vendors that hold sensitive or regulated data. Shared Assessments built SIG Lite and SIG Core around the same split.

NIST's supply chain quick-start guide makes the same point from the buyer's side: scale requirements to each supplier's criticality and to the damage a compromise would cause, and assess critical suppliers before you buy. A typical tiering looks like this.

If you sell a SaaS product, assume most enterprise buyers will put you in the top tier, and have the evidence ready before the first deal. Reviews don't end at signature either. NIST asks buyers to keep security measures in service level agreements for the whole supplier relationship, so expect a new questionnaire at renewal, after a security incident, or when the scope of what you handle changes.

What does a security questionnaire ask?

Most questionnaires cover the same ground: governance, data protection, access control, vulnerability management, incident response, business continuity, third parties, privacy, and compliance evidence. Each question expects a direct answer, and many expect a document that proves it. The table below works as a starting template for your own answer library.

Two rows trip up a lot of teams. For third parties, expect to list every subprocessor: the European Data Protection Board's Opinion 22/2024 says controllers should have the identity of all processors and sub-processors readily available at all times. For compliance, check dates before you paste a certificate: SGS, a certification body, states that ISO/IEC 27001:2013 certifications expire or should be withdrawn by October 31, 2025, so a current certificate should name the 2022 version.

What do security questionnaires ask about your website?

More than most marketing teams expect. Your website collects personal data through forms, cookies, and chat, and it loads third-party scripts that receive visitor data. Privacy sections can ask about any of it. And when the vendor under review is your web agency or website platform, the whole questionnaire is about the site.

Three of these have their own guides on our blog: how to route Webflow forms to Salesforce or HubSpot, how to set up Consent Mode v2 on a Webflow site, and what a hosted platform takes off your patch list.

The same logic runs the other way. When your security team reviews your website vendors, ask them for the same things: the platform's audit reports, the agency's process for granting and removing access, and a DPA if they touch personal data.

We build websites for B2B SaaS and cybersecurity companies, so we have an interest in the topic.

How do you answer a security questionnaire faster?

Answer from a maintained library, not from scratch. Keep one approved answer for each common question, with an owner, an evidence link, and a review date, and build it from your latest SOC 2 report or completed CAIQ. Each new questionnaire then becomes a matching exercise instead of a research project.

The time adds up. Vanta, which sells compliance software, says its customers spend 5 to 15 hours on each security review, and more in highly regulated industries. That estimate comes from the vendor's conversations with customers, not from a survey, so treat it as a rough order of magnitude.

1. Complete one standard questionnaire first. The CAIQ is free and covers most cloud questions. Posting it to CSA's STAR Registry makes it easy to share.
2. Build the answer library. For each question: the approved answer, the owner, the evidence link, the date last reviewed, and an expiry date for anything that lapses, such as certificates and pen test letters.
3. Route questions to owners. Security answers controls, IT answers devices and access, legal answers the DPA and contract terms, product answers data flows and AI, and marketing answers the website and trust page.
4. Answer what is asked. Lead with yes or no, then one or two sentences of detail. Mark "not applicable" with a reason. Never claim a control you don't have; describe the gap, any compensating control, and a target date.
5. Publish the standard answers. A public trust page with your security overview, certifications, subprocessor list, and completed CAIQ answers many questions before they arrive, though enterprise and regulated buyers often still send their own.
6. Refresh on a schedule. Review the library after every audit, pen test, or new subprocessor, and at least once a year.

AI drafting tools can match new questions to library answers. Check every draft against current evidence before it goes out: a wrong answer is still a statement your company made to a customer.

Questions about security questionnaires