Guides
Security questionnaire guides.
Written for the vendor who just received the spreadsheet — not the team that sent it. Start with the step-by-step process, then go deep on your format. To understand the laws behind the questions, see our Canadian privacy law hub.
Most downloaded this month: the SIG Lite answer library template — 33 worked answers across 14 SIG-style risk domains, each mapped to ISO 27001 / NIST CSF / CSA CCM.
SIG Lite answer-library template (CSV)
33 worked answers across 14 SIG-style risk domains, each mapped to ISO 27001 / NIST CSF / CSA CCM. Evidence-citation columns built in.
SIGWhat is the SIG questionnaire? A 2026 guide
What the SIG is, Core vs Lite, what reviewers actually check, and how to return defensible answers in days.
How-toHow to answer a security questionnaire
You just got one and the deal is gated on it. Triage, honest answers, evidence citing, and the mistakes that stall deals.
PIPEDAPIPEDA and Canadian privacy questionnaires
The ten principles as question structure, breach-of-safeguards duties, and the cross-border rows Canadian buyers read first.
SOC 2SOC 2 questionnaires: what buyers actually ask
Report vs questionnaire vs evidence request — and how to respond credibly even without a SOC 2 report.
ComparisonOutsourcing: done-for-you vs AI tools vs DIY
An honest 2026 comparison of cost, speed, and risk — including when we'd tell you not to hire us.
CAIQHow to answer the CAIQ: a step-by-step guide
CCM control IDs, the SSRM shared-responsibility column, STAR Level 1 vs per-customer responses, and CAIQ-Lite triage.
ISO 27001ISO 27001 supplier questionnaires
Answering with or without the certificate — Annex A mapping, the SoA excerpt strategy, and the honest not-certified pattern.
HIPAAHIPAA BAAs and security questionnaires
What a business associate actually commits to: the safeguard triad, breach-notification clocks, subcontractor flow-down.
InsuranceCyber insurance applications
Answer them like warranties, because they are — the minimum-bar five, as-of-date precision, renewal diffing.
Law 25Quebec Law 25 vendor questionnaires
Person-in-charge, PIAs for outside-Quebec transfers, confidentiality incidents, and the register — the asks unique to Quebec.
PHIPAPHIPA questionnaires for Ontario health vendors
Agent vs electronic service provider, the audit-logging row, and why importing HIPAA answers fails Ontario reviews.
Or skip the reading and send us the questionnaire.
SIG, CAIQ, SOC 2 evidence requests, cyber-insurance forms — answered truthfully in about 3 days, at a fixed price quoted up front.
Get questionnaire rescue →