Skip to content

SIG Lite and CAIQ-Lite: what they ask and how long they take

What the SIG Lite and CAIQ-Lite vendor security questionnaires are, who publishes them, how many questions they run, and the red flags reviewers spot.

By Blank Slate Creative. . Updated

OrderYour security questionnaire answered, $85 flat. Up to 125 questions.

Order the questionnaire

A larger customer is ready to sign. Then procurement sends a spreadsheet and a due date. The file is usually one of two things, or a custom sheet that borrows heavily from them: the SIG Lite or the CAIQ-Lite. This guide covers what each one is, who publishes it, how long it runs, how long a good set of answers takes, and what makes a reviewer stop trusting a response.

What each questionnaire is

SIG Lite

The SIG is the Standardized Information Gathering questionnaire, created and updated by Shared Assessments. Usually the customer sends you the file.

Mitratech, a SIG licensee, says SIG Lite “typically serves vendors that require less due diligence or are not as critical”, and calls the heavier SIG Core “an extensive assessment”. In our reading, getting a Lite rather than a Core suggests your customer treats you as a lower-risk vendor.

CAIQ-Lite

The CAIQ is the Consensus Assessments Initiative Questionnaire, from the Cloud Security Alliance (CSA). It is built on the CSA’s Cloud Controls Matrix (CCM), and it documents the security controls of cloud services: IaaS, PaaS, and SaaS. The CAIQ-Lite is the shortened version, built on CCM v4.1 and released in January 2026.

One distinction matters if you sell software. The CSA’s STAR Level 1 page names the full CAIQ v4.1 as the form you use to submit to its public STAR Registry. We read that as meaning the Lite is not the registry form, so confirm with the CSA before you submit one. If a customer asks for “the CAIQ”, ask which one they mean before you start.

How many questions

The counts below are as each source reports them. They change between editions.

  • SIG, 2025 edition: Mitratech, a SIG licensee, reports 128 questions in SIG Lite and 627 in SIG Core, across 21 risk categories (December 2024). We have not confirmed these counts with Shared Assessments.
  • CAIQ-Lite (CCM v4.1): 138 questions across 17 control domains. Source: the CSA.
  • Full CAIQ v4: 261 questions, down from 310 in version 3.1. Source: the CSA’s 2021 announcement of v4. Check the current v4.1 file for its count.
  • Custom customer questionnaires vary too widely to quote a typical length. Many borrow from the two above.

So a Lite is not small. Both run well over 100 questions, and each is a spreadsheet with a comment column. Count the questions on day one, and skip any that are only section headings.

What the questions cover

Both cover much the same ground, in different words: who has access to what and how you control it, how data is encrypted, how you log and detect problems, how you handle an incident, how you manage your own vendors, what policies you have and when they were last reviewed, and how you back up and recover. The full CAIQ v4 also has Shared Security Responsibility Model columns, where a provider says who is responsible for implementing each control: itself, the customer, or a third party.

How long a good answer set takes

We have no measured average to give you, and we would rather say so than invent one. Here is the arithmetic instead, and it is our estimate, not a benchmark. Suppose you spend about three minutes a question on a sheet of about 120 questions. That is roughly six hours of focused work.

The catch is that the writing is the short part. The long part is finding out what is true: which identity provider you use, whether multi-factor authentication is on for everyone, where logs go, when the incident policy was last reviewed. If those answers are in one person’s head, a working day is realistic. If they are spread across an engineer, an office manager, and a contractor, plan on a few calendar days, because the delay is waiting for replies.

Three things shorten it:

  1. Gather the facts first: cloud provider, identity provider and multi-factor method, logging, backups, incident process, and the policies you already have.
  2. Ask the customer for the deadline and whether a partial set with gaps marked is acceptable. Do this before you begin.
  3. Keep every finished answer in one place. The second questionnaire should take much less time than the first.

Common red flags

These come from how the questionnaires are built and how a reviewer has to read them. They are our judgment, not survey data.

  • Every answer is a plain “Yes.” A reviewer who sees a hundred unexplained yeses assumes nobody read the questions.
  • “N/A” on something that plainly applies. Marking logging or access control not applicable reads as evasion.
  • Answers that contradict your other documents. The questionnaire says you encrypt everything, and your own privacy notice or policy says otherwise. A reviewer can check one against the other.
  • A planned control described as a live one. If it is not running today, say “not yet” and give the date. A false answer is a formal statement to your customer, and it can turn into a contract problem after the sale.
  • Someone else’s controls claimed as yours. Your cloud host’s certifications cover the host. They do not cover your application or your team.
  • Absolutes. “All data is always encrypted everywhere” is almost never true, and one exception voids it. Say what is encrypted, with what, and where.
  • Stale or undated policies. A policy with no owner and no review date suggests it was written to answer this sheet.
  • Leftover text from another customer’s sheet. Reused answers need a read-through for the wrong names and terms.

A gap is not a failure. In our judgment, an honest “not yet, and here is the plan,” or a compensating control described accurately, serves you better than an answer that falls apart on the first follow-up question. We cannot promise your customer will approve anything, because every reviewer sets their own threshold.

If you would rather hand it off

Blank Slate Creative, LLC answers vendor security questionnaires. Here is what the service looks like.

  • A flat fee, published up front. Up to 125 questions is $85, and 50 more is +$45, so up to 175 is $130. Both Lites run past 125 on the counts reported above (128 for the 2025 SIG Lite, per Mitratech, and 138 for CAIQ-Lite, per the CSA), so count yours and plan on the add-on. The order covers SIG Lite, CAIQ-Lite, and custom questionnaires. Order the questionnaire, $85.
  • You give us facts, we write the answers. After you pay, we email a few short questions on your cloud, identity and multi-factor setup, existing policies, and deadline, ask for the questionnaire file, and send a longer intake on your actual controls.
  • You get your completed questionnaire as a populated .xlsx or .csv file (a Word questionnaire comes back as a spreadsheet), with anything that needs your check flagged for your review, plus a plain Markdown summary of your posture, the flagged items, and any documentation gaps.
  • Check the timing first. We deliver three business days after the day we have your file and answers, and four with the add-on. If your due date is tighter than that, email us before you order.
  • What it is not. It is readiness and documentation work only: never an audit, an attestation, or a certification, and not penetration testing. We will not invent answers for controls you do not run, and we do not guarantee that your customer will approve.

Sources

All read on 2026-09-29. Counts change between editions, so check the current one.

Related guides

← All guides