Security Questionnaire Readiness: Answer Once, Answer Consistently

These failures are structural rather than moral. A clinical-stage company with thirty people and a real product almost always has adequate controls and almost never has the artefacts that let someone else verify it. The gap between having controls and being able to evidence them is the entire problem, and it widens quietly until the first serious buyer asks.

The first failure is the absence of a control narrative. The company encrypts data at rest, reviews access quarterly and runs change management through pull requests, but no document says so. Every questionnaire is therefore an act of original composition. The second failure follows immediately: evidence is scattered. Policies live in Notion, screenshots in a Slack thread, the penetration test PDF in somebody’s inbox, the data processing agreement in a signed-contract folder nobody can search. The cost of assembling the evidence dominates the cost of writing the answer, which is why a questionnaire that looks like a two-hour job consumes a week.

The third failure is that nobody owns it. In a twenty-person biotech the questionnaire lands on the CTO, who is also the constraint on shipping. Vanta, drawing on its own analysis of the burden, puts the effort at five to fifteen hours per questionnaire; in a small company those hours come directly out of engineering capacity at the exact moment the deal needs the product to keep moving.

The fourth failure is inconsistency across instruments. The Standardized Information Gathering questionnaire, the Consensus Assessments Initiative Questionnaire and a customer’s bespoke Word document ask the same underlying question in three vocabularies. Without a canonical answer bank the company contradicts itself, and a buyer who receives two questionnaires six months apart notices. Contradiction reads as incompetence or concealment, and neither impression is recoverable inside a deal cycle.

The fifth failure is timing. Diligence is discovered at the point of maximum leverage loss: after the internal champion has sold the project, before signature. What should have been a project becomes a schedule risk, and the pressure to give a fast confident answer is precisely the pressure that produces the sixth and most damaging failure, which is overclaiming. Saying SOC 2 compliant when there is no report. Saying ISO certified when a consultant performed a gap assessment. Saying HIPAA compliant, which is a category error because HIPAA has no certification and nobody can issue one. A reviewer who catches a single overclaim discounts every other answer on the form, including the true ones.

There is a strategic point buried in the burden data that is worth stating directly. In the same analysis, Vanta cites RiskRecon research finding that only 34 percent of third-party risk management professionals believe questionnaire responses are accurate. The instrument is distrusted by the people who send it. That is not a reason to answer it badly; it is the reason that verifiable evidence beats additional prose. A current penetration test with a remediation record, a published self-assessment, and a policy set with real approval dates move a reviewer further than another thousand words of assertion.

The instrument is already distrusted. Verifiable evidence persuades where additional prose does not.

There is no single questionnaire. There is a small set of published instruments, a large set of bespoke ones derived from them, and one archived project that keeps appearing in vendor-risk articles as though it were current. Knowing which one you have received changes what you should do about it, because two of them can be pre-empted for free and the rest cannot.

The Standardized Information Gathering questionnaire is published by the Shared Assessments Program as part of its third-party risk management toolkit, on an annual release cycle, with SIG Lite as the low-risk screening tier and SIG Core as the comprehensive tier for higher-risk providers. Both can be scoped by risk domain and control family. It is licensed rather than free: access requires membership or a product subscription, which is also why its exact question counts are not publicly published and should be treated with suspicion when quoted. The most significant change in the 2026 release, per Mitratech’s analysis of it, is a comprehensive mapping to ISO/IEC 42001, which pushes AI governance into every SIG-based programme in a single step. In March 2026 Shared Assessments launched SIG Evolution, moving the questionnaire from a spreadsheet to a browser-based platform while retaining Excel compatibility.

The Consensus Assessments Initiative Questionnaire is the Cloud Security Alliance’s instrument, aligned one-to-one with the Cloud Controls Matrix. CCM v4.1, released on 27 January 2026, contains 207 controls across 17 security domains. CAIQ v4 contains 261 questions, down from 310 in v3.1, and CAIQ-Lite contains 124 questions while still addressing all of the matrix domains. This is the instrument to build your answer bank around, for a structural reason: CAIQ maps to CCM, and CCM maps to almost everything else, so answering CAIQ once produces reusable answers for instruments you have not seen yet.

The AI-specific successor arrived on 9 July 2025, updated on 30 October 2025. The CSA AI Controls Matrix contains 243 control objectives across 18 security domains for cloud-based AI systems, and ships with a companion AI-CAIQ and a STAR for AI Level 1 submission guide. For an AI vendor selling into life sciences it is currently the closest thing to a standard AI-specific self-assessment, and it costs nothing.

The Higher Education Community Vendor Assessment Toolkit is published by EDUCAUSE with Internet2 and REN-ISAC, currently at HECVAT 4, revision 4.1.5, and version 4 explicitly added privacy and AI questions. It is free to colleges, universities and their vendors, though third-party risk platforms need a licence to embed it. It matters to life sciences whenever the counterparty is an academic medical centre or a university research office, which for a biotech is a very common partner and a frequently unanticipated instrument.

Google’s Vendor Security Assessment Questionnaire is the one to be careful about. It was an influential open-source interactive questionnaire application under an Apache 2.0 licence, and it popularised the conditional branching questionnaire that most modern platforms now use. Its repository was archived by its owner on 25 November 2022 and is read-only. It is still listed as a current instrument in vendor-risk articles, and quietly correcting that in a conversation with a reviewer is a small but real credibility marker.

There is no pharmaceutical equivalent of the SIG for information security, and assuming there is one leads to a specific and avoidable embarrassment in front of a quality lead. What exists instead is three separate strands that are frequently confused with each other, only one of which is the instrument that will actually arrive.

The Pharmaceutical Supply Chain Initiative is a member-driven scheme whose Principles for Responsible Supply Chain Management cover ethics, labour and human rights, health and safety, environment, and management systems. Data privacy and security appears within it as a sub-principle under ethics, not as a security framework. PSCI runs a shared audit programme so that one audit can serve many members, which is genuinely useful, but a page or a sales conversation that presents PSCI as a security questionnaire will be wrong in a way a pharma quality lead spots instantly. It is a responsible-business instrument.

Rx-360 is an international pharmaceutical supply chain consortium that runs an audit operations working group and a shared audit programme, oriented to good manufacturing practice and material-integrity supply chain risk rather than to information security.

The instrument that actually arrives for a software or AI vendor is the GxP supplier qualification questionnaire and audit, and it is a company-specific document rather than a published standard. It is driven by EU GMP Annex 11 sections 3 and 7, EU GMP Chapter 7, ICH Q10 section 2.7 and GAMP 5 Appendix M2. Because every regulated company writes its own, the questions are unpredictable, the format varies, and answering cold is expensive. That unpredictability is exactly why a control narrative written once in the quality register as well as the security register pays for itself: the underlying facts are the same, and the work is translation rather than rediscovery.

The AICPA Code of Professional Conduct does not treat the independence of a SOC 2 examiner as a matter of degree. Interpretation 1.295.030, on management responsibilities, states that if a member were to assume a management responsibility for an attest client, the management participation threat would be so significant that no safeguards could reduce the threat to an acceptable level and independence would be impaired.

The named management responsibilities include, in terms that could hardly be more directly on point, accepting responsibility for designing, implementing, or maintaining internal control, and performing ongoing evaluations of the attest client’s internal control as part of its monitoring activities. In other words, the two activities that make up the bulk of readiness work are precisely the two activities the eventual examiner may not perform.

Interpretation 1.295.145, on information systems design, implementation or integration, extends the same logic into technology: independence is impaired if the member designs or develops an attest client’s financial information system, makes more than insignificant source-code modifications, supervises attest client personnel in the daily operation of an information system, or operates an attest client’s network.

Interpretation 1.295.040 sets out the general requirements that make any non-attest service possible at all, and its conditions describe the shape of a healthy readiness engagement from the client’s side. The client must agree to assume all management responsibilities, designate an individual, preferably within senior management, who possesses suitable skill, knowledge and experience to oversee the service, evaluate the adequacy and the results of the services performed, and accept responsibility for the results of the services. That is not fine print. It is the reason your company needs a named internal owner for this work even when an external firm is doing most of the writing.

Practitioners state the rule more bluntly. Writing on the readiness versus audit split, Atticus Rowan puts it as AICPA independence standards prohibiting the audit firm from having a material role in designing, operating or maintaining the control environment they are auditing, and summarises the consequence in a single line: the firm constructing your SOC 2 program cannot issue the report.

The ISO side of this is even more explicit. ISO/IEC 17021-1:2015 sets out the principles and requirements for the competence, consistency and impartiality of bodies providing audit and certification of all types of management systems, and it frames certification as a third-party conformity assessment activity performed by third-party conformity assessment bodies.

Clause 5.2.5 admits of no exceptions. As quoted by European Accreditation in its own guidance on the clause, the certification body and any part of the same legal entity and any entity under the organizational control of the certification body shall not offer or provide management system consultancy. The standard then defines management system consultancy in a way that closes the obvious loopholes: participation in establishing, implementing or maintaining a management system, with preparing or producing manuals or procedures, and giving specific advice, instructions or solutions towards the development and implementation of a management system, given as examples.

Read that list against what an information security management system implementation actually involves and the picture is clear. The body that will certify you cannot write your policies, cannot write your procedures, and cannot tell you specifically how to implement a control. It can audit what you built and say whether it conforms. For AI management systems the same architecture is extended by ISO/IEC 42006:2025, which supplements 17021-1 with AI-specific competence and process requirements for the bodies certifying against 42001.

So the market structure is not an accident and it is not a gap someone should close. There are meant to be two parties: one that helps you build a real management system, and one, entirely independent of the first, that examines whether it works. The uncomfortable version of this for consultancies is that it also means no preparation firm can promise you a certificate, because no preparation firm controls the decision. Anyone who promises one is either describing something other than certification or is telling you something about how they treat other claims.

Two parties by design: one builds the management system, an entirely separate one decides whether it conforms.

The output of readiness work is a small number of artefacts that answer many different instruments. This is the list we work through, ordered so that the earliest items carry the most weight per hour spent. Most companies discover that items one to three answer the majority of what actually arrives, and that the later items are what turn a passable submission into one that closes the diligence rather than extending it.

It starts with a one-page security overview and a system or architecture description: what the system is, where its boundaries are, how data flows through it, and which sub-processors are involved, named. Then the canonical answer bank, keyed to CAIQ v4 questions, because CAIQ maps to the Cloud Controls Matrix and the Cloud Controls Matrix maps to nearly every other instrument. Answering once and mapping many is the whole economic argument for doing this work as a project rather than reactively.

Third, and this is the highest-leverage single move available to a small vendor, publish a completed CAIQ to the CSA STAR Registry. A STAR Level 1 submission is a self-assessment, it is free, and it is publicly listed and machine-findable, which means it pre-empts a share of inbound questionnaires before they are sent. For an AI product, submit an AI-CAIQ as well. STAR Level 2 is third-party audited and comes in variants: STAR Certification, which leverages ISO/IEC 27001 together with the Cloud Controls Matrix and carries three-year validity, STAR Attestation, which uses SOC 2 engagements with AICPA criteria plus the matrix and carries one-year validity, and C-STAR for Greater China.

Then the policy set, versioned with real approval dates: information security, access control, change management, incident response, business continuity and disaster recovery, secure development lifecycle, data retention and deletion, sub-processor management, and AI or model governance. Then the evidence artefacts, which is where most packs are thinnest: the latest penetration test report with remediation status, vulnerability scan cadence, access review records, backup restore test records, an incident response tabletop record, and training completion records.

The legal pack is next and is more contested than most companies expect. A data processing agreement carrying genuine GDPR Article 28(3) obligations, including the right under Article 28(3)(h) to allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller. A sub-processor list with a notification mechanism, because Article 28(2) requires prior authorisation and, under general authorisation, the chance to object to changes; Article 28(4) keeps the original processor fully liable for its sub-processors. A business associate agreement template where protected health information is in scope, meeting the content requirements at 45 CFR 164.504(e). Standard contractual clauses under Commission Implementing Decision 2021/914 where transfers require them, retained as a fallback even where the EU-US Data Privacy Framework applies; the General Court dismissed the Latombe challenge to that framework on 3 September 2025 while stressing that the Commission is required to monitor continuously the application of the legal framework on which the adequacy decision is based.

Two clauses in a business associate agreement break AI vendors specifically, and it is better to discover this while writing your pack than while answering a hospital’s counsel. The return-or-destroy obligation at termination, which requires retaining no copies where feasible, collides with abuse-monitoring logs and with embeddings held in vector stores. And the access, amendment and accounting-of-disclosures obligations collide with architectures where personal health information has been transformed into embeddings that cannot be individually located or amended. A pack that has a considered answer to both is meaningfully ahead of one that does not.

Finally, a trust page that is findable without a sales call and states plainly what the company does not have, and a change log, because a stale pack is worse than no pack. The gap list is part of the deliverable rather than an embarrassment: a documented no with an owner and a date reads as competence, while a vague yes reads as risk.

If your product involves a language model, a growing part of the questionnaire is about the model rather than about your infrastructure, and the reviewer wants clauses rather than marketing pages. The good news is that the underlying facts are usually publicly documented by the model providers themselves, which means a defensible answer is a matter of citation rather than negotiation.

Start with training. Anthropic’s commercial terms state that Anthropic may not train models on Customer Content from Services. OpenAI’s platform documentation states that as of 1 March 2023, data sent to the OpenAI API is not used to train or improve OpenAI models unless the customer explicitly opts in, and its enterprise privacy page states that it does not train on customer data by default and that custom models are the customer’s alone and are not shared. Microsoft’s Azure AI Foundry documentation states that prompts, completions, embeddings and training data are not used by providers of models sold by Azure to improve their models or services, and that the models are stateless. The point for your pack is to say which of these applies to your actual deployment, and to name the model provider.

Then retention, where the honest answer is more nuanced than the training answer and where an unprepared vendor gets caught. OpenAI documents that by default, abuse monitoring logs are generated for all API feature usage and retained for up to 30 days unless longer retention is required by law, and that Zero Data Retention and Modified Abuse Monitoring are subject to prior approval by OpenAI and acceptance of additional requirements. Azure has a parallel application path and publishes a verifiable check: a ContentLogging value in the capabilities list appears and is set to false when abuse-monitoring logging is off. If your pack claims zero retention, include the approval evidence rather than the assertion.

Residency is a deployment-type question rather than a headquarters question, and this is the single most common error in an otherwise good answer. Azure’s documentation is explicit that for any deployment type labeled Global, prompts and responses may be processed in any geography where the relevant model sold by Azure is deployed. A vendor can be genuinely hosted in the EU and still have prompts processed globally. The same documentation is a useful benchmark for the specificity a reviewer should expect elsewhere: human reviewers access flagged data only via point-wise queries using request IDs, Secure Access Workstations and just-in-time request approval granted by team managers, the abuse-monitoring data store is logically separated by customer resource, fine-tuned models are exclusively available to the customer whose data created them, and for models deployed in the European Economic Area the authorised Microsoft employees are located in the European Economic Area.

The governance layer sits on top. NIST’s AI Risk Management Framework 1.0, released on 26 January 2023, is voluntary and organised around four functions, govern, map, measure and manage, with the Generative AI Profile, NIST AI 600-1, released on 26 July 2024. It confers no certification and no safe harbour, but it is a useful shared vocabulary in a questionnaire response. The OWASP Top 10 for LLM Applications, published by the OWASP Gen AI Security Project, is the best free structure for the technical half of the answer and names risks that no general questionnaire covers, including excessive agency and vector and embedding weaknesses.

On the EU AI Act, get the dates right, because most published timelines are now stale and a reviewer who spots an outdated one will assume you copied it. Regulation (EU) 2024/1689 entered into force on 1 August 2024. Prohibited practices and AI literacy obligations applied from 2 February 2025, and governance rules and general-purpose AI model obligations from 2 August 2025. The Act became generally applicable on 2 August 2026, including the Article 50 transparency obligations. Then the Digital Omnibus on AI, Regulation (EU) 2026/1744, was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026, deferring the bulk of the Chapter III high-risk obligations to 2 December 2027 for stand-alone Annex III high-risk systems and 2 August 2028 for high-risk AI embedded as a safety component of a regulated product. What did not move: the Article 5 prohibitions, the general-purpose AI obligations in force since August 2025, and the Article 50 transparency duties. Penalties under Article 99 run up to €35,000,000 or 7 percent of total worldwide annual turnover for Article 5 breaches, up to €15,000,000 or 3 percent for most other operator breaches, and up to €7,500,000 or 1 percent for supplying incorrect or misleading information to authorities, whichever is higher in each case, except that for SMEs including start-ups each fine is capped at whichever figure is lower.