PressmarkSIG vs CAIQ vs HECVAT vs VSA: which security questionnaire is it?
A US buyer sends you a spreadsheet and you do not know which standard it is. This page compares four common ones. The figures below are approximate and come from one third-party summary, so check the current version with the publisher before you rely on them.
The four at a glance
| Questionnaire | Published by | Approx. questions | Usually sent by |
|---|---|---|---|
| SIG (SIG Lite is the short form) | Shared Assessments | 800+ full; about 200 Lite | Financial services, healthcare, insurance, large enterprises |
| CAIQ | Cloud Security Alliance | About 260 | Cloud and technology buyers |
| HECVAT (Full and Lite) | EDUCAUSE / HEISC | About 250 full; about 80 Lite | Higher education |
| VSA | Vendor Security Alliance | About 100 to 150 | Technology companies and startups |
Source: Agency’s security questionnaire overview, read Nov 8 2026. Question counts change between versions. The CAIQ is also published through the CSA STAR program.
How to tell which one you were sent
- Look at the file name and first tab. Most name the standard.
- Check the sender. A university usually means HECVAT. A bank or insurer often means SIG.
- If it is a custom spreadsheet, treat it as its own format. Many buyers send their own.
Why one answer can serve all four
The same topics recur: access control, encryption, incident response, backups, vendor management. Write each answer once, with an owner, evidence and a review date, as in the answer library template. Then paste the matching answer into whichever format arrives. Re-read it for wording that does not fit the question before you send.
Keep the answers honest
Do not claim a control you do not run. If you have no SOC 2 report, say so plainly and add what is true. The basics are in the customer security questionnaire guide.
See the concept
Early concept in validation. The call is a 20-minute conversation, not a software demo.