Answering a security and privacy questionnaire
What the CAIQ, CCM, OWASP ASVS and NIST frameworks are, how a questionnaire answer relates to evidence, and the questions to bring to counsel.
General information as of October 10, 2026. It is education written by World Enterprise Editorial, not legal, security or financial advice, and not an offer or solicitation of any kind. A lawyer and a qualified security professional can say what applies to your company and your answers.
A customer or an investor’s adviser sends a spreadsheet with a few hundred rows: do you encrypt data at rest, do you have an incident response plan, who are your sub-processors. This article describes the common questionnaire formats and the standards behind them as formats, explains what an answer to a question is, and lists questions to bring to counsel. It does not tell you how to answer, and it does not suggest your company holds, or lacks, any certification.
The formats, described
A sender can use a form published by a standards body or write its own. The sources read for this article describe the published ones.
The CAIQ. The Cloud Security Alliance, the CSA, describes its Consensus Assessments Initiative Questionnaire as an industry-accepted way to document what security controls exist in cloud services, offering a set of yes or no questions a cloud consumer and cloud auditor may wish to ask of a cloud provider. The page for version 3.1 says that version is no longer accepted to the CSA’s STAR Registry and points to version 4, which it says has been combined with the Cloud Controls Matrix.
The CCM. The CSA’s Cloud Controls Matrix is a cybersecurity control framework for cloud computing, which the CSA says is composed of 197 control objectives structured in 17 domains. Its page says the CAIQ is built into the CCM and that version 4.1 of the two is now combined.
OWASP ASVS. OWASP says the Application Security Verification Standard provides a basis for testing web application technical security controls.
NIST frameworks. NIST describes its Cybersecurity Framework as helping organizations better understand and improve their management of cybersecurity risk. Its page on the Secure Software Development Framework refers to established secure software development practice documents from organizations such as BSA, OWASP and SAFECode.
None of these is a law, and no source here says a company must complete any of them. A sender may ask a question in the words of one standard, several or none. Which standard a sender is working from is a question to ask the sender.
Where privacy questions come from
Some privacy questions can be read against the law. The General Data Protection Regulation, which the privacy basics article describes, gives two examples.
- Security of processing. Article 32 says the controller and the processor shall implement appropriate technical and organisational measures, and it lists, as appropriate, the ability to ensure ongoing confidentiality, integrity, availability and resilience, the ability to restore the availability and access to personal data in a timely manner, and a process for regularly testing, assessing and evaluating effectiveness.
- Processors and sub-processors. Article 28 says processing by a processor shall be governed by a contract or other legal act that sets out, among other things, the subject-matter and duration of the processing, and that a processor shall not engage another processor without prior specific or general written authorisation.
A questionnaire row asking about restoring data or about sub-processors can therefore be read as a question about whether the company has those things in place and can show them. Whether the regulation applies to your company is a question for counsel.
What an answer is
An answer to a row is a statement the company makes about itself on a given date. If the answer is yes, the next question a careful reader asks is what record shows it. That is the same pairing the article on ordering a pre-seed evidence pack describes: a statement and the artifact behind it.
The pairing can be laid out by section:
| Checklist section | What the answer states | A record that would back it |
|---|---|---|
| Accounts and access | Who can reach which systems | An access list; the sign-in settings |
| Code and build | How changes are reviewed and released | Review settings; the release log |
| Data | What is held, where, and how it is protected | A data inventory; a backup test note |
| Vendors | Who handles customer data | A vendor list and the terms read |
| Logging and response | Who acts on an incident and how | A written plan; a log of a practice run |
The first column uses section names from the security baseline checklist, which has six sections and is a self-assessment in the same shape: yes, partly or no, with an owner and a date. The checklist says it does not certify anything and maps loosely to public references such as OWASP ASVS and the NIST SSDF.
Self-assessment and certification are different objects
A self-assessment and a certification or third-party attestation are different objects. That distinction is the one a questionnaire reader cares about. A completed form is a self-statement. A certificate or a report from an outside assessor is something else. The records for each kind differ, and so do the words that describe them accurately.
Whether any statement in a particular answer is accurate and how it is worded are questions for counsel and a security professional. These sources do not describe how a company’s answers have been treated in disputes.
Where the answers live afterward
An answered questionnaire is itself a record. The guide to the seed data room has a security and privacy folder holding a data inventory, an access list, the privacy notice and the vendors that handle customer data, and it says every file should carry a date. Dated answers make it possible to say what was true when a form was sent. The open-source license article describes the license side of the components a code and build answer refers to.
Questions to bring to counsel
The questions to ask your counsel before you sign is a general list. For a questionnaire:
- Which standard or custom form is the sender using, and who wrote the questions?
- Which answers are statements about facts we can document, and which are statements about intentions or plans?
- Is the questionnaire part of a contract, or does a signature or an attestation attach to it?
- Do any answers describe our use of personal data, and do they agree with our privacy notice?
- Which questions touch laws that may or may not apply to us, such as the GDPR?
- Who reviews the draft answers before they are sent, and where is the sent version kept?
- How do we word an answer when the honest reply is partly, no or not yet?
What this article cannot tell you
It does not say how to answer any question, which standard to adopt or whether any certification is worth holding. It does not describe the content of the CCM’s controls, of ASVS or of the NIST frameworks beyond what their own pages say.
It describes the formats and does not assess a company’s security. A completed questionnaire is a statement and not a test, and nothing here suggests a company meets any standard. It does not cover contract terms, insurance, or industry-specific rules for health or finance.
The sources were read on October 10, 2026. Questionnaire versions are retired and replaced, as the CAIQ page itself shows, so a decision should rest on the version the sender actually uses and on a professional who has seen your systems.
In the data
These figures describe U.S. businesses in general, not WE’s results. Each one names its source.
Show the data as a table
| Firm age | Share of jobs and of firms, 2023 |
|---|---|
| Age 0 to 5 | 10.7% of jobs, 36.2% of firms |
| Age 6 to 10 | 7.8% of jobs, 16.4% of firms |
| Age 11 to 15 | 6.8% of jobs, 10.9% of firms |
| Age 16 to 25 | 12.4% of jobs, 15.9% of firms |
| Age 26 and older | 24.2% of jobs, 15.4% of firms |
| Founded before 1977 (exact age not measured) | 38.1% of jobs, 5.4% of firms |
The Census Bureau cannot date firms born before 1977, so they are shown on their own; every one of them was at least 45 years old in 2023.
Source: U.S. Census Bureau, Business Dynamics Statistics, firm age , 1978 to 2023
Retrieved 2026-10-16. Each share is the sum of the published employment (or firm) counts of the age classes in the group, divided by the sum over all classes, which equals the economy-wide total in bds2023.csv.
Sources
- Consensus Assessment Initiative Questionnaire (CAIQ) v3.1, Cloud Security Alliance . Accessed October 10, 2026.
- Cloud Controls Matrix (CCM), Cloud Security Alliance . Accessed October 10, 2026.
- OWASP Application Security Verification Standard (ASVS), OWASP Foundation . Accessed October 10, 2026.
- Cybersecurity Framework, National Institute of Standards and Technology . Accessed October 10, 2026.
- Secure Software Development Framework (SSDF), National Institute of Standards and Technology . Accessed October 10, 2026.
- Regulation (EU) 2016/679 (General Data Protection Regulation), EUR-Lex, Publications Office of the European Union . Accessed October 10, 2026.
Spotted an error? Read how we handle corrections in our editorial policy.