A security questionnaire is a set of technical questions to assess an organization’s security and compliance posture. In the context of a vendor risk management (VRM) program, questionnaires are a great tool to determine whether a third-party vendor can be trusted with access to the network, and ultimately, whether to do business with them or not.
Your company is probably working with dozens or hundreds of third party vendors managing all kinds of outsourced processes. However, their access to your network can increase the risk of suffering a third-party data breach if not properly monitored.
Requesting third parties to respond to security questionnaires is considered a cybersecurity best practice across most industries today. It helps you collect the data you need to perform thorough vendor risk assessments and make informed decisions.
How can you begin using security questionnaires? You can:
- Use industry standard questionnaires created by a trusted entity
- Use industry questionnaires as a model and tailor them based on your organization’s needs and use cases
- Create your own custom questionnaire from scratch
The most commonly used questionnaires in vendor risk management programs include SIG Core and SIG Lite, CAIQ, CAIQ Lite and CIS Controls. You can integrate them into your overall VRM program with a dedicated tool like Bitsight VRM.
Using Security Questionnaires in Bitsight VRM
Bitsight VRM is a tool that automates the end-to-end vendor management process —from due diligence to reassessment and ongoing monitoring. It provides the ultimate risk dashboard to gain visibility over your supply chain and metrics to quantify risk.
Our platform supports all of the most commonly used security questionnaires, so you can easily integrate them into your VRM process:
Consensus Assessments Initiative Questionnaire (CAIQ)
The CAIQ provides a set of Yes/No questions for cloud service providers, such as Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) offerings, to determine if their cloud practices are reliably secure.
Bitsight VRM includes access to CAIQ v4. It has a reduced number of questions aligned with the Cloud Controls Matrix (CCM) v4, a cybersecurity control framework for cloud computing that is considered the de-facto standard for cloud security and privacy. CCM v4 incorporated additional controls and improved language that favors the implementation and evaluation of the controls.
CIS Controls
The assessments formerly known as the SANS Critical Security Controls (SANS Top 20) and the CIS Critical Security Controls, were recently consolidated and are now officially called the CIS Controls. After a revision of terminology and grouping of safeguards, the number of controls was reduced from 20 to 18.
Bitsight VRM includes access to CIS Controls V8, the latest version, introducing control renaming and consolidation.
Standardized Information Gathering Questionnaire (SIG Core & SIG Lite)
The SIG Questionnaire evaluates vendors based on 18 individual risk controls to define how they manage security risks. It is updated every year, reflecting new security and privacy challenges.
Bitsight VRM includes access to SIG Lite and SIG Core, 2022 and 2023 versions. The latest version introduced a new Environmental, Social, and Governance (ESG) domain and a new Nth-Party Management domain. In addition, the Security Policy domain was removed, and its content was relocated to the Nth-Party Management and Information Assurance domains.
