thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Security Questionnaire

Standardized set of questions used to assess a third party's security and privacy controls.

Definition

Common standardized questionnaires include the Shared Assessments SIG (Standardized Information Gathering), CSA CAIQ, and HECVAT for higher education. Responses should be validated with evidence for higher-risk vendors because self-attestations can be inaccurate. Trust centers and shared assessment exchanges reduce questionnaire fatigue.

Example

A bank sends the SIG Lite to a moderate-risk marketing vendor and the full SIG to a core processor.

Exam tip

Self-reported questionnaire answers are weaker evidence than independent audit reports.

Related terms