Security questionnaires are now a sales bottleneck
If you sell software to businesses, security questionnaires arrive with almost every serious deal. Whistic’s 2025 TPRM Impact Report, a vendor survey of 525 respondents, found that “The average vendor in 2025 responds to 37.3 assessment requests each month,” taking about 179 hours a month, and that “84% of assessment responses require additional follow-up” (Whistic). Vanta’s 2025 State of Trust survey found teams spend 9 working weeks a year on vendor security reviews and risk assessments, up from 7 (Vanta via Business Wire).
Both figures come from companies that sell compliance software, so read them as directional. But the trend is consistent: more questionnaires, more follow-up and more questions about AI.
This guide explains the questionnaire formats you will see in 2026, how AI security questionnaire automation works, and how to speed up answers without making claims your controls cannot back up.
For the buyer’s side: how to assess a vendor’s security, see Vendor Security Assessment: Process, Evidence and Software.
The questionnaires you will see in 2026
| Questionnaire | Publisher | Size (latest confirmed) | 2025–2026 changes |
|---|---|---|---|
| SIG Lite / Core / Detail | Shared Assessments | SIG 2025: 128 (Lite), 627 (Core), 1,936 (Detail) questions across 21 risk domains (Shared Assessments) | SIG 2026 formalizes Lite/Core/Detail presets and “explicitly codifies AI governance and operational resilience,” with an ISO 42001 mapping (Mitratech, a TPRM vendor) |
| CAIQ | Cloud Security Alliance | CAIQ v4.0: 261 questions; CAIQ-Lite: 124 (CSA) | CCM v4.1 released January 27, 2026 with 207 controls in 17 domains (CSA); v4.0 withdrawn from STAR in January 2028 (CSA) |
| AI-CAIQ / AICM | Cloud Security Alliance | AICM v1.1: 247 control objectives (CSA) | AICM v1.0 released July 9, 2025, mapped to ISO 42001 and NIST AI RMF; STAR for AI certification is “upcoming” |
| Custom spreadsheets and RFP security sections | Each customer | Varies | Increasingly include AI usage and data training questions |
The big shift is AI governance. Both SIG and CSA now build AI controls into their standard question sets. Expect customers to ask whether you use AI, which models, how you govern them and whether customer data trains them.
How AI questionnaire automation works, and where it goes wrong
Most tools follow the same pattern:
- Build a knowledge base from past answers, policies, SOC 2 and ISO 27001 reports, and trust center content.
- Parse the incoming questionnaire, whether spreadsheet, portal or document.
- Retrieve and draft answers from the knowledge base, ideally with links to the source.
- Route to owners for review, then export in the customer’s format.
The accuracy risk is legal, not just reputational
A questionnaire answer is a representation to a customer. Recent enforcement shows why specific security claims need to match reality:
- SEC v. SolarWinds. The SEC voluntarily dismissed the case in November 2025 (Covington). But earlier, the court had let claims proceed only on the company’s website Security Statement. Commentators advise “aligning public statements with verified technical reality” (Harvard Law School Forum).
- FTC v. GoDaddy. The FTC’s May 2025 final order addressed claims of “award-winning security” and bars the company from misrepresenting its security and its compliance with standards programs (FTC).
AI raises this risk in two ways. It can produce a confident answer from an outdated policy, and it can stretch a partial control into a “Yes.” The safeguards are simple: every drafted answer should cite the current source document, and a named owner should approve anything that describes a specific control.
What to look for in security questionnaire software
| Evaluation area | Ask the vendor | Red flag |
|---|---|---|
| Source citations | Does every drafted answer link to the policy, report or control evidence it came from? | Answers with no visible source |
| Freshness | How are answers flagged when the source policy or SOC 2 report changes or expires? | Knowledge base never re-validated |
| Confidence and “unknown” | Does the tool say when it cannot find support, instead of guessing? | Every question gets a confident “Yes” |
| Framework support | SIG 2026, CAIQ v4.1, AI-CAIQ and customer spreadsheets? | Only one format |
| AI governance answers | Can it handle AI usage, model and data-training questions from a governed source? | AI questions answered from marketing copy |
| Owner approval | Are control-specific answers routed to named owners with an audit trail? | Bulk export without review |
| Data handling | Are your documents used to train the vendor’s models? | Vague terms |
Measure success by accepted answers with no follow-up, not by speed alone. Whistic’s 84% follow-up rate suggests the real time sink is the back-and-forth after submission.
The other side of the questionnaire
Every questionnaire you answer is one your customer has to assess. The two jobs use similar technology but have different goals:
| Answering (seller side) | Assessing (buyer side) | |
|---|---|---|
| Goal | Respond fast and accurately | Decide whether the vendor’s evidence supports its claims |
| Input | Your knowledge base | The vendor’s SOC 2, ISO 27001, policies and answers |
| Main risk | Overstating controls | Accepting claims the evidence does not support |
Answers hold up best when they are built the way a careful buyer will check them: claim, then evidence. AskDona assesses security evidence against the requirements you choose and cites the passage behind every finding. Use it to check that your own answers are supported before they go out, or to assess the vendors you buy from.
Try a security evidence assessment on your current SOC 2 report and answer library.
FAQ
What is security questionnaire automation? Software that drafts answers to customer security questionnaires from a library of approved answers and source documents, then routes them for review.
How many questions are in the SIG? SIG 2025 has 128 questions in Lite, 627 in Core and 1,936 in the full Detail version (Shared Assessments). SIG 2026 counts are licensed content and not publicly confirmed.
What changed in the CAIQ in 2026? CSA released CCM v4.1 on January 27, 2026. CSA STAR accepts both v4.0 and v4.1 until December 2027 (CSA).
Can AI answer security questionnaires safely? Yes, if every answer cites a current source and control-specific answers are approved by an owner. Inaccurate security statements can create legal exposure, as the SolarWinds and GoDaddy cases show.
Will trust centers replace questionnaires? Many vendors claim so, but we found no independent data showing it. Gartner notes organizations still “rely predominantly on cyber risk questionnaires” (Gartner).
References
All pages opened and checked by October 9, 2026.
| Source | Type | Date | Used for |
|---|---|---|---|
| Whistic: 2025 TPRM Impact Report takeaways | Vendor survey | 2025 | 37.3 requests/month, 84% follow-up |
| Vanta State of Trust 2025 (Business Wire) | Vendor survey | Oct 29, 2025 | 9 weeks/year on reviews |
| Shared Assessments: SIG Lite vs Core vs Detail | Standards body | c. late 2024 | SIG 2025 question counts |
| Mitratech: SIG 2026 key updates | Vendor blog | Mar 5, 2026 | SIG 2026 changes |
| CSA: What is CAIQ | Standards body | Sep 1, 2021 | CAIQ v4 counts |
| CSA: CCM v4.1 | Standards body | Jan 27, 2026 | 207 controls, 17 domains |
| CSA: CCM v4.1 transition timeline | Standards body | Feb 19, 2026 | STAR transition |
| CSA: AI Controls Matrix v1.1 | Standards body | Jun 22, 2026 | AICM, STAR for AI |
| Covington: SEC dismisses SolarWinds | Law firm | Nov 21, 2025 | Case status |
| Harvard Law School Forum: SolarWinds dismissed | Legal commentary | Dec 7, 2025 | Security statement lessons |
| FTC: GoDaddy final order | Regulator | May 21, 2025 | Security misrepresentation |
| Gartner: Cyber risk questionnaires research | Analyst | Feb 12, 2024 | Reliance on questionnaires |