Start with the vendor's standard questionnaire if they have one, then send a short custom addendum for what it misses: your data flow, source code handling, SSO and roles. This saves both sides time and keeps your questions focused on the risks specific to a tool that reads your code.
What the standard option is
The Cloud Security Alliance publishes the Cloud Controls Matrix, a control framework with 197 control objectives in 17 domains. The Consensus Assessment Initiative Questionnaire, CAIQ, is a set of yes or no questions built on that matrix to assess cloud providers. The CSA also describes a STAR Level 1 self assessment that providers can submit to a public registry. Vendors answer it once and reuse it, which is why many offer it.
A self assessment is the vendor's own statement. It tells you which controls they claim, not that anyone verified them.
Comparing the approaches
| Approach | Strength | Weakness |
|---|---|---|
| Vendor's standard CAIQ | Fast, familiar, reused across buyers | Generic, may not cover code handling |
| Your full custom questionnaire | Fits your policy exactly | Slow, vendors answer in copied text |
| Hybrid: standard plus short addendum | Speed plus relevant depth | Needs you to know your risks first |
Steps for the hybrid
- Ask for the vendor's completed standard questionnaire and any independent reports at the start.
- Read it against your requirements and mark gaps.
- Write an addendum of 10 to 15 questions about the gaps. Typical topics for an AppSec tool: what source or metadata is read and stored, retention and deletion, tenant isolation, roles and SSO, audit logs, AI features, subprocessors, incident notice.
- Ask for evidence where an answer matters: a policy extract, a screenshot of a setting, a test result.
- Record answers in your vendor register with a review date.
What to watch for in answers
Short answers of yes with no detail on a question that deserves one. Answers that cite a certification without scope. Copied marketing language. See red flags in vendor security questionnaire answers.
When a full custom questionnaire is justified
Regulated buyers sometimes must ask specific questions to meet their own obligations, and the vendor will understand. In that case still pre fill what you can from the standard answers, and ask only for the delta.
Keep it proportionate
A tool with read access to all repositories deserves more depth than a documentation plugin. Tier the vendor first. See how to tier vendors by risk.
Safeguard supports compliance and evidence automation, and a free scan is available at gold.safeguard.sh/scan.
Quick check
Is a CAIQ the same as an audit?
No. A self assessment is the vendor's statement. An independent audit or attestation is a separate thing, so ask which one you are reading.
How many custom questions is reasonable?
Aim for the gaps only, often 10 to 15. Longer lists tend to produce copied answers rather than better assurance.
Sources
Last reviewed: 19 October 2026.
