Need one questionnaire family drafted?
The entry pilot is USD 850 for one family, paid in full at checkout. You get cited drafts from your own approved sources, marked “needs input” where they do not answer, for your reviewer to approve.
Get your questionnaire family drafted - $850Prefer to test first? Try one sourced answer free, no signup.What are the CAIQ and the SIG?
The CAIQ (Consensus Assessment Initiative Questionnaire) comes from the Cloud Security Alliance and maps to its Cloud Controls Matrix. Version 4 has 261 questions, down from 310 in version 3.1. It is also the questionnaire used for STAR Level 1 self-assessments.
The SIG (Standardized Information Gathering questionnaire) is maintained by Shared Assessments and is used in third-party risk reviews. It comes in scoped versions: SIG Lite for lower-risk vendors and SIG Core for deeper reviews, and buyers often trim it to a custom subset.
How do I answer them faster without cutting corners?
1. Build one approved source library
Collect your current security policies, SOC 2 or ISO 27001 report, architecture overview, data-flow notes, subprocessor list and your last few approved questionnaires. Have the security owner mark what is current. Everything else is out of bounds.
2. Map questions to controls, not keywords
"Is data encrypted at rest?" and "Describe your storage encryption" are the same control. Map each question to the control and the document section that proves it, and the same evidence answers dozens of variants.
3. Reuse approved answers, then check they are still true
Past answers save the most time, and cause the most risk when a policy has changed. Check each reused answer against the current document.
4. Flag gaps, don't fill them
If no approved document supports an answer, mark it for a person. A short "we will follow up" is better than a confident answer that a customer later finds untrue.
5. Get a named approval and keep the record
Have one accountable person approve the final set, and keep which sources and reviewers produced it. It makes the next questionnaire faster and answers the "how did you produce this?" question from auditors.
How does Shuttlewright help?
Shuttlewright runs these steps as a governed workflow: it retrieves passages only from your approved library, maps each question to controls and evidence, drafts answers with a citation for every claim, flags low-confidence answers and gaps for review, and stops at an approval gate before anything goes out. Every run is recorded in a tamper-evident audit log. It is an early product, currently in paid pilots with design partners.
See it on your next CAIQ or SIG
Five-day paid pilot on one source library and one questionnaire family.
See the design-partner pilotFrequently asked questions
How many questions are in the CAIQ?
CAIQ version 4 has 261 questions, according to the Cloud Security Alliance, down from 310 in version 3.1.
What is the difference between SIG Lite and SIG Core?
Both come from Shared Assessments. SIG Lite is a shorter set for lower-risk third parties; SIG Core is the deeper assessment for higher-risk relationships. Buyers often send a custom subset.
Can I reuse answers across CAIQ, SIG and custom questionnaires?
Yes, if you map questions to underlying controls and evidence rather than wording. The same approved evidence usually answers many differently worded questions.
Should AI write security questionnaire answers?
AI can draft them from your approved documents and cite the source for each answer. A person should review and approve before anything is sent.
Sources
- Cloud Security Alliance, CAIQ v4 changes (261 questions): https://cloudsecurityalliance.org/blog/2021/06/07/caiq-v4-released-changes-from-v3-1-to-v4
- Cloud Security Alliance, STAR Level 1 questionnaire (CAIQ v4): https://cloudsecurityalliance.org/artifacts/star-level-1-security-questionnaire-caiq-v4
- Shared Assessments, Which SIG to use: https://sharedassessments.org/wp-content/uploads/sa-uploads/2024/09/Which-SIG-To-Use_2023Nov29-1.pdf