Security questionnaire guide
Learn how buyer assessments differ, what evidence reviewers expect, and how responses move through review.
Security and procurement reference
Last reviewed July 12, 2026
Security questionnaire and RFP glossary
Plain-language definitions for RFP security questions, questionnaire standards, DDQs, vendor risk, trust centers, security controls, and compliance frameworks. Every entry links to related terms and practical guidance.
What is the difference between an RFP and a security questionnaire?
An RFP evaluates overall solution, delivery, and commercial fit. A security questionnaire focuses on security, privacy, resilience, and compliance controls. Buyers may attach a security questionnaire to an RFP or send it later in due diligence. Keep shared company facts consistent, but route security claims and evidence through the designated control owners and reviewers.
The terms overlap in real procurements, but the decision owners and evidence requirements differ. Use the table below to identify the instrument before reusing prior answers.
RFP and security questionnaire formats
| Instrument | Primary purpose | Typical source |
|---|---|---|
| RFP | Compare solution, implementation, service, and commercial fit. | Buyer-authored procurement document |
| Security questionnaire | Assess security, privacy, resilience, and compliance controls. | Buyer-authored or standardized assessment |
| SIG | Standardize broad third-party risk assessment and scoping. | Shared Assessments |
| CAIQ | Assess cloud controls using questions aligned to the Cloud Controls Matrix. | Cloud Security Alliance |
| VSAQ | Review vendor security and privacy using the VSA-Full or VSA-Core instrument. | Vendor Security Alliance |
Browse all 39 terms
Definitions include operational context, related controls, and links to deeper guides.
AI Hallucination
AI hallucination is when a model generates plausible but factually wrong output — a critical risk that evidence-backed questionnaire automation prevents.
Audit Trail
An audit trail is a chronological record of system activities providing documentary evidence for compliance and security questionnaire verification.
Business Associate Agreement (BAA)
A BAA is the HIPAA-required contract governing how a vendor handles protected health information. Covered entities must sign one with every vendor touching PHI.
Business Continuity Plan (BCP)
A business continuity plan outlines how an organization continues operations during and after a disruption, commonly evaluated in vendor security reviews.
BYOK AI (Bring Your Own Key)
BYOK AI allows customers to supply their own API keys for AI services, ensuring data never passes through the vendor's AI infrastructure.
CAIQ (Consensus Assessments Initiative Questionnaire)
CAIQ is a cloud security questionnaire developed by the Cloud Security Alliance (CSA) to evaluate cloud service providers against the CSA Cloud Controls Matrix.
Cloud Controls Matrix (CCM)
The CSA Cloud Controls Matrix is a cloud security and privacy control framework; CCM v4.1 contains 207 controls across 17 domains and accompanies CAIQ.
Compliance Pack
A compliance pack is a curated bundle of security docs delivered to buyers during procurement: SOC 2, policies, certifications, and pen test summaries.
Data Processing Agreement (DPA)
A DPA is a contract that governs how a vendor processes personal data on behalf of a customer. GDPR-focused security reviews require one.
Data Residency
Data residency refers to the geographic location where data is stored and processed, a critical concern in security questionnaires for regulated industries.
Evidence Library
An evidence library is a centralized repository of approved security docs, policies, and prior responses used as source material for questionnaire answers.
FedRAMP
FedRAMP (Federal Risk and Authorization Management Program) is the US government program that standardizes security assessment for federal cloud services.
GDPR
GDPR (General Data Protection Regulation) is the EU law governing personal data protection, with major implications for vendor security reviews and DDQs.
GRC (Governance, Risk, and Compliance)
GRC (Governance, Risk, and Compliance) is an integrated framework for managing governance structures, enterprise risk, and regulatory compliance.
HIPAA
HIPAA (Health Insurance Portability and Accountability Act) establishes standards for protecting sensitive patient health information in the United States.
Incident Response
Incident response is the organized approach to addressing and managing security breaches and cyberattacks, frequently evaluated in buyer questionnaires.
ISO 27001
ISO 27001 is the international standard for information security management systems (ISMS), specifying how to establish, implement, and maintain controls.
MFA (Multi-Factor Authentication)
MFA requires users to verify identity with two or more factors and is one of the most common control checks in enterprise security questionnaires.
NDA (Non-Disclosure Agreement)
An NDA is a legal agreement gating access to sensitive compliance docs. Buyers sign NDAs before viewing SOC 2 reports, pen tests, and security architecture.
NIST Cybersecurity Framework
The NIST Cybersecurity Framework (CSF) is a set of standards for managing cybersecurity risk. Organizations of all sizes adopt it voluntarily.
PCI DSS
PCI DSS is a security standard for organizations that handle credit card data. It mandates specific controls for cardholder data protection.
Penetration Testing
Penetration testing is authorized simulated attack used to evaluate system security. Pen test results are common evidence in security questionnaires.
Procurement Portal
A procurement portal is a dedicated workspace where vendors deliver curated security documentation, compliance packs, and follow-up materials to buyers.
RBAC (Role-Based Access Control)
RBAC is an access control method that assigns permissions based on user roles, commonly asked about in security questionnaires and compliance reviews.
Security Questionnaire
A security questionnaire is a set of questions buyers use to evaluate a vendor's security posture and compliance during procurement.
Security Questionnaire Automation
Security questionnaire automation structures intake, evidence retrieval, reviewable drafts, ownership, exceptions, approvals, and buyer-ready delivery.
Shared Responsibility Model
The shared responsibility model defines which security controls the cloud provider owns versus the customer — referenced often in cloud security reviews.
SIG Questionnaire
The Shared Assessments SIG is a standardized questionnaire for evaluating third-party technology, security, privacy, resilience, and operational risk.
SLA (Service Level Agreement)
An SLA is a formal agreement defining service commitments — uptime guarantees, response times, support levels — commonly evaluated in vendor security reviews.
SOC 2
SOC 2 is an AICPA audit framework evaluating service organizations on five Trust Services Criteria covering security, availability, integrity, and privacy.
SSO (Single Sign-On)
SSO allows users to authenticate once to access multiple applications. It is a frequently required capability in enterprise security questionnaires.
Subprocessor
A subprocessor is a third party that processes personal data on behalf of a data processor. Security reviews require vendors to disclose all subprocessors.
Third-Party Risk Management (TPRM)
Third-party risk management (TPRM) is the discipline of identifying, assessing, and mitigating risks from external vendors, suppliers, and service providers.
Trust Center
A trust center is a public-facing web page where vendors publish their security posture, compliance certifications, and documentation for buyers.
Vendor Risk Assessment
A vendor risk assessment evaluates a third-party vendor's security, compliance, and operational risks before and during the business relationship.
Vendor Risk Scoring
Vendor risk scoring assigns numerical risk ratings to vendors based on questionnaire responses, compliance documentation, and external threat intelligence.
Vendor Security Review
A vendor security review is the end-to-end process where a buyer assesses a vendor's security posture via questionnaires, documentation, and risk scoring.
VSAQ (Vendor Security Alliance Questionnaire)
VSAQ commonly refers to the Vendor Security Alliance questionnaire, available as VSA-Full and VSA-Core for standardized vendor security reviews.
Zero Trust Architecture
Zero Trust is a security model requiring strict identity verification for every user and device, increasingly referenced in enterprise security questionnaires.
Start with the full guides
Due diligence questionnaire guide
Compare vendor, investment, regulatory, and transaction DDQs without treating them as one format.
SaaS security questionnaire guide
Review cloud, identity, API, resilience, privacy, and evidence questions used in SaaS procurement.
Trust center best practices
Evaluate access controls, evidence currency, ownership, buyer workflow, and measurable outcomes.
Primary standards and source notes
Definitions were checked against the publishers below. Framework versions, licensing, and access terms can change, so confirm the current source before issuing or answering an assessment.