SIG Lite vs SIG Core vs CAIQ — which questionnaire to use

If you are choosing between them: SIG Lite for a first pass on most vendors, SIG Core when the vendor holds regulated or sensitive data, CAIQ when the vendor is a cloud service provider and you want an answer they have probably already written.

The rest of this is why, and what each one costs the person on the other end.

The three at a glance

The number that matters most is the last row of the middle column. SIG Core is weeks of a vendor's time. Send it to forty suppliers and you will get a low response rate, slow answers, and — worse — answers filled in by somebody guessing to make the request go away.

SIG Lite

The Standardized Information Gathering questionnaire's short form. Around 125 questions across the same risk domains as Core, chosen to give you a broad read without the depth.

It is good at triage. Send it to a new vendor, get an answer inside a week, and use it to decide whether this relationship needs a real assessment or is fine as-is. Most vendors are fine as-is, and the value of Lite is that it lets you establish that cheaply and move on.

It is bad at assurance. A yes to "do you encrypt data at rest" tells you the vendor believes they encrypt data at rest. It is a claim, not evidence, and Lite is not structured to chase it.

SIG Core

The full instrument. 850+ questions, deep coverage across access control, application security, resilience, physical security, third-party management, privacy and more.

Core is the right tool when the answers will genuinely change your decision — a vendor processing regulated data, holding a large customer dataset, or sitting on a critical path where an outage is your outage. In those cases the depth is proportionate and vendors expect it.

It is the wrong tool as a default. The failure mode is specific and worth naming: a questionnaire long enough to be answered carelessly produces worse information than a short one answered attentively, while costing both sides far more. If you are sending Core to every vendor, you are not being thorough — you are collecting 850 fields of noise.

CAIQ

The Cloud Security Alliance's Consensus Assessments Initiative Questionnaire, around 261 questions mapped directly onto the Cloud Controls Matrix.

CAIQ has one enormous practical advantage: many cloud providers have already completed it, and published it in the CSA STAR registry. Before you send anything, check the registry. A completed CAIQ that already exists costs you nothing and arrives immediately.

Its scope is genuinely cloud-shaped — multi-tenancy, virtualisation, data residency, provider-versus-customer responsibility. That specificity is a strength against a SaaS or IaaS provider and a weakness against, say, a payroll bureau, where a good third of it will not apply.

The CCM mapping is the underrated part. Because every question ties to a control that maps onward to ISO 27001, SOC 2 and others, a CAIQ answer can often be traced to something in your own framework rather than sitting in a silo.

How to choose, in practice

Tier the vendor first, then pick the instrument. Roughly:

Low impact — no access to your data, easily replaced, an outage is an annoyance. No questionnaire. Check they exist, check for public breaches, move on. Sending a questionnaire here is theatre that costs two people a day each.

Medium impact — holds some customer data, or an outage degrades your service. SIG Lite, or a published CAIQ if they are a cloud provider.

High impact — regulated data, large datasets, or a hard dependency. SIG Core, or Lite plus targeted follow-up. And ask for their SOC 2 report or ISO certificate, which is worth more than any self-assessment.

Any tier, if they have one — take the SOC 2 Type II. What that report does and does not cover is in what auditors actually ask for. An independent auditor testing controls over a period beats a self-completed questionnaire on every axis. The questionnaire's job then narrows usefully: cover what the report's scope excludes.

The thing questionnaires do not do

A completed questionnaire is a set of claims by a party with an interest in the answers. That is not a criticism — it is what the instrument is for. The mistake is treating the returned document as the assessment rather than the beginning of one.

The questions worth asking of any answer: what evidence supports it, when was it last true, and who at the vendor is accountable for it. A "yes" with a linked audit report and a date is worth twenty bare yeses.

This is the gap Cyberwiz vendor management was built for. Responses come back into a record that tracks which claims were evidenced, which were taken on trust, what the residual findings are and when the whole thing goes stale — because a questionnaire answered eighteen months ago describes a company that may no longer exist in that form. Throughput is the wrong metric. A hundred questionnaires processed and none followed up is a busy programme, not a working one.

Practical notes

• Check STAR before sending anything to a cloud provider. The answer may be public already.
• SIG requires a Shared Assessments membership. CAIQ is free. That is a real factor for a small team.
• Do not mix instruments across a tier. Comparing a Lite answer to a Core answer across two vendors is comparing different questions.
• Version matters. SIG is revised annually; a 2023 SIG and a 2026 SIG differ. Record which you sent.
• Set an expiry when you file the response. Most programmes never revisit an answered questionnaire, which quietly turns the whole exercise into a filing habit.