If you Google the term “data breach,” you’ll see daily reports of personal information leaked into the cybersphere, often from companies that believe their security systems are impenetrable.
Generally, their systems are (nearly) impenetrable, so how do all those bad actors access valuable customer data? You might be surprised to know that in many cases, they snuck in on the backs of 3rd- and even 4th-party vendors.
According to the HIPAA Journal, 55% of healthcare organizations suffered 3rd-party data breaches in 2021.
Additionally, a Gartner survey showed that:
- 88% of boards see cybersecurity as a business risk rather than solely an IT problem
- 60% of organizations replied that by 2025, they might only engage in business with companies who have demonstrated proper cybersecurity practices
To ensure proper cybersecurity practices, organizations issue security questionnaires, which are lists of generally yes/no questions addressing vendors’ security protocol.
Some security questionnaires may even want to know about your vendors’ vendors—also known as tier 3 vendors. Security questionnaires will also ask for certificates of proof as issued by the regulatory agency or security authority.
Why do companies issue security questionnaires?
“Security leaders are under a lot of pressure to show quick wins while knowing full well that everything they do will be heavily scrutinized and challenged, and ultimately, they will pay the price for things that are not under their control.” ~ Yaron Levi, CISO at Dolby
You may often hear that cybercriminals are savvy. Indeed, some are clever hackers who deliberately target specific companies that collect a lot of sensitive data. One such example is the big box chain unfortuitously, at least in this situation, named Target.
In most cases, however, cybercriminals owe their success more to tenacity than skill. Like a car thief tugging on every door in a parking lot, cybercriminals look for openings to penetrate vulnerable systems, at tremendous cost to their victims.
In 2022, the average cost of a data breach is $9.4 million per incident. That figure doesn’t take hidden costs into account, such as:
- Increased insurance premiums
- Credit rating hits
- Operational disruption
- Decreased customer confidence
- Loss of contracts
- Loss of intellectual property
- A devalued trade name
Safeguarding your systems means ensuring that bad actors can’t access company or customer data through 3rd-party vendors, which is why 2 out of 3 companies require proof of safety compliance from their software vendors.
What’s in a security questionnaire?
Security questionnaire topics vary between organizations and industries. You may have to answer questions about the following:
- Application security – Do you have an up-to-date SSL certificate?
- Audit & compliance – Are you compliant with California’s CCPA and Europe’s GDPR?
- Protection Regulation — Are you GDPR compliant in addition to other compliance requirements?
- Business continuity – Do you have systems in place to continue operations during an outage?
- Disaster recovery – How long will it take to notify customers of a breach? How will you address the breach?
- Change control – How do you roll out emergency change control, such as security patches?
- Data/information security – What are your security guidelines?
- Data privacy – How and how often do you backup your data?
- Encryption management – Do you use encryption or cryptographic techniques in your systems?
- Governance & risk management – Do you have records of security events?
- Human resources – Are employees trained in security protocol?
- Identity & access management – Do you offer single sign-on (SSO)?
- Physical security – How do you secure your physical assets and ensure on-premises privacy?
- 3rd party management – 4th-party breaches happen. How do your vendors vet their vendors?
- Vulnerability management – How do you conduct vulnerability analyses?
Most common types of security questionnaires
Not surprisingly, security questionnaires are not cookie-cutter documents. Depending on your industry, your prospect’s industry, and rapidly growing InfoSec risks and changes, you could see multiple types of security questionnaires in your inbox.
CIS Critical Security Controls (CIS First 5 / CIS Top 18)
The Center for Internet Security (CIS) is a non-profit organization that aims to safeguard organizations of all kinds against security threats.
A CIS Critical Security Control questionnaire lists 18 (previously 20) “Controls,” or prioritized sets of actions, that industries should take to protect their systems and data from cyber-attacks. The Controls include questions about managing your network and assets, protecting data, training employees to guard against threats, etc.
Consensus Assessments Initiative Questionnaire (CAIQ)
The Consensus Assessments Initiative Questionnaire (CAIQ) is a security questionnaire provided by the Cloud Security Alliance (CSA). The objective is to assess the security of your cloud service provider if you store data on the cloud.
A CAIQ is substantially longer than the modest 18 questions in the CIS questionnaire. In their questionnaire, the CSA asks multiple questions about your infrastructure as a service (IaaS), platform as a service (PaaS), and software as a service (SaaS) offerings.
The questionnaire, a series of yes/no questions, is typically customized to the customer’s specific needs and use cases.
ISO 27001 questionnaire
The ISO 27001 questionnaire was developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The questionnaires are sent to 3rd-party vendors to assess the information security of their IT systems and data processes.
The ISO 27001 is one of the best-known and most widely used security questionnaires and includes questions about how your organization uses resources and tools.
The questionnaire covers topics related to your vendor relationships, conflict resolution processes, contractual security requirement enforcement, how you monitor 3rd-party services, and whether you audit 4th-party risks. Additionally, the issuer typically wants to ensure their ability to audit your systems and processes.
Standardized Information Gathering questionnaire (SIG Core & SIGLite)
The Standardized Information Gathering (SIG) questionnaire, created by Shared Assessments, assesses risks across 18 domains, including IT processes, resiliency, data security, privacy, resilience, and more.
There are two types of SIG questionnaires, including the standard SIG Core questionnaire and SIGLite. The SIG Core questionnaire includes about 850 questions for a deep dive into a vendor’s security processes. The SIGLite has about 330 questions for a higher-level view of the vendor’s controls.
SIGLite is often the first security questionnaire. Once the prospect is comfortable with those answers, they may follow up with a SIG Core.
California Consumer Privacy Act questionnaire (CCPA)
On January 1, 2020, a law went into effect in California called the California Consumer Privacy Act. The law is designed to provide transparency, protect consumer privacy, and provide them with choices in how their information is collected and shared.
The CCPA applies to companies that conduct online business in California, have annual revenue exceeding $25 million, possess personal information from more than 50,000 people, and earn half their revenue from selling personal data.
If your company resides outside of the State of California, it might not matter. The law is considered extraterritorial in that it applies to all companies that meet the criteria, regardless of state or continent.
CCPA security questionnaires are not standardized, but CCPA questions could be part of a more extensive security questionnaire. Alternatively, you might receive one specifically tailored to California regulations.
General Data Protection Regulation questionnaire (GDPR)
Before California enacted the CCPA, the European Union passed its own data-handling law called the General Data Protection Regulation (GDPR).
The GDPR is similar to the CCPA in that it’s also extraterritorial. The GDPR, however, has no minimum criteria. It applies to all online organizations, including non-profits, that collect and process data from EU residents.
One significant difference between the two regulations is that while the CCPA allows people to opt-out of sharing their data, the GDPR requires that people opt-in. Companies must also provide EU residents with information about how they retain data and why they’re collecting it. Users can also withdraw their consent at any time.
The EU has a checklist that can serve as a security questionnaire. As with the CCPA, you might see these questions or similar as a stand-alone security questionnaire or as part of a broader one.
National Institute of Standards and Technology (NIST SP 800-171)
In the United States, no federal laws begin to match California’s or the EU’s regulations. Still, the federal government has stringent laws surrounding government data handling.
The National Institute of Standards and Technology is part of the US Department of Commerce. It’s also one of the country’s oldest physical science laboratories. More recently, they’ve been a leading force in IT security.
With the help of large tech organizations, NIST created a set of guidelines designed to protect data. While NIST compliance isn’t mandatory, it is required of all contractors and subcontractors that work with the federal government.
NIST standards are considered best practices for most organizations, even those that don’t do business with the government. NIST compliance questionnaires cover topics such as asset management, governance, risk assessment, access control, data security and so on.
Payment Card Industry Data Security Standards questionnaire (PCI DSS)
The Payment Card Industry Standards Security Council (PCI Security Standards Council) created standards to protect consumers from credit card fraud. The guidelines are primarily for B2C businesses, but it’s also essential for purchasers to know that their 3rd-party vendors handle credit card transactions responsibly.
The PCI Security Standards Council’s list of questions for vendors asks about overall security, where information is stored, vendor integrations, onboarding procedures, etc. You might see the list on its own or as part of a more comprehensive security questionnaire.
What you need to successfully respond to security questionnaires
No one—okay, almost no one—likes filling out security questionnaires. They’re long, tedious, boring, and there’s no room for creating a compelling narrative. Unfortunately, setting security questionnaires aside isn’t an option. Refusing to submit one can force your organization to lose a deal or even an existing customer.
Security questionnaires have dozens to thousands of questions about how vendors handle growing security risks. Similarly to a request for proposal (RFP) or due diligence questionnaire (DDQ), a security questionnaire is time-sensitive and requires input from multiple stakeholders.
Not only should you have systems in place to protect your data, but you should also have procedures for responding to a security questionnaire.
Effective knowledge management
Security questionnaires are legal documents. Beyond just answering “yes” or “no,” you will need to prove compliance with documentation. An effective knowledge management system puts answers and documentation at your fingertips.
Responsive’s AI-enabled recommendation engine can automatically suggest answers to up to 80% of an RFP’s queries. Imagine what it can do for a straightforward, repetitive document like a security questionnaire.
Seamless team collaboration
A security questionnaire response team can include dozens of people. An organization’s response manager might be in charge of completing the document, but they will need help from risk management, IT, sales engineering, information security, operations, HR, and/or accounting.
Responsive’s pricing model is unique among response management applications and rare among SaaS companies. Instead of charging a per-user license fee, Responsive provides unlimited access to users by charging per-project.
Maintained accuracy
If you indicate on a security questionnaire that you are compliant, it had better be accurate. Misrepresenting security compliance could lead to litigation.
A knowledge management system should be your single source of truth, which is especially important for security questionnaire responses. Responsive’s Content Library is a single repository for all your company knowledge and documents, including security compliance certificates.
Driven by machine learning, the Content Library provides auditing tools such as reminders and reports so you can be confident that everything in your library is accurate and up-to-date.
Automation at scale
The road to information security is long, windy, rocky, and once you think you’re there, the destination moves. As standards are created, cybercriminals find ways around them. If an organization waits for new standards before updating its protocol, it might be too late.
Security safety calls for resilience which can mean adding to tech stacks and hiring additional information security personnel.
Responsive’s automated processes grow right along with your needs. The Content Library is limitless, and adding new users is as simple as assigning permissions.
Project management
It’s imperative that you issue security questionnaire responses on time as well as accurately. Responsive’s project management features clarify responsibilities, assign manageable tasks, and produce reports to ensure everything is going as planned.
Once you’ve issued your response, trend analytics is like a post-game wrap-up that tells you how the project compared to similar projects and how many resources were used.
Finish security questionnaires faster with Responsive
A report by Whistic revealed that salespeople spend an average of 6.8 hours a month answering security questionnaires. And, 54% of responding companies said they’d lost deals because they couldn’t complete the questionnaires on time.
Responsive helps organizations prove compliance at record speed, giving back more time to security teams so they can focus on higher-value work. If you’d like to learn more about security questionnaire software for fast, efficient, scalable, and accurate security questionnaire responses, get in touch.
