Security Questionnaire Answer Library Template (CAIQ, SIG, ISO/IEC 27001)

Security Questionnaire Answer Library: [Organization name]

A controlled library of approved answers to customer security questionnaires, due diligence requests and tender security sections. It holds one approved answer per topic, the evidence behind it, the owner who vouches for it, the sharing tier (public, under NDA, never shared) and the review date. It supports ISO/IEC 27001:2022 + Amd 1:2024 clause 7.4 (communication with interested parties), clause 7.5 (control of documented information) and Annex A controls A.5.31 (legal, regulatory and contractual requirements), A.5.34 (privacy and PII protection) and A.5.12 (information classification), with guidance from ISO/IEC 27002:2022. Domains are organised so that answers can be reused for the CSA Consensus Assessments Initiative Questionnaire (CAIQ v4.1) and the Shared Assessments SIG, cited by name and domain only. No question text from either is reproduced. Replace every [bracketed] value and every row marked Example.

Document control

Approvals

Revision history

Contents

• 1. Purpose and scope
• 2. Roles and ownership
• 3. Rules for honest answers
• 4. Library structure and domains
• 5. Answer record format
• 6. Approved answers
• 7. Sharing tiers, evidence and NDA gating
• 8. Response workflow
• 9. Questions without an approved answer
• 10. Review cadence and change triggers
• 11. Measures
• 12. Size tiers
• 13. Records and evidence
• 14. References

1. Purpose and scope

This library gives [Organization name] one approved, evidence-backed answer for each security and privacy topic that customers, prospects, partners and auditors ask about. It exists so that:

• answers are consistent across sales, customer success, security and legal, and across time;
• every answer matches what the ISMS actually operates, as recorded in the Statement of Applicability (DOC-ISMS-011) and the control evidence matrix (DOC-ISMS-033);
• confidential evidence is only shared with the right party, under the right agreement;
• questionnaire effort falls over time because work is reused.

Scope of the library:

2. Roles and ownership

Domain owners (Example, Quillmere Analytics Ltd):

3. Rules for honest answers

Every responder follows these rules. Breaking them is handled through the disciplinary process for security breaches (DOC-ISMS-052) when it is deliberate.

4. Library structure and domains

The library uses the 17 domains of the CSA Cloud Controls Matrix v4.1 (CCM v4.1, 207 controls, released 2026-01-27; CSA allows a transition period from v4.0, so some customers still send CAIQ v4.0.x) as its primary index, because CAIQ v4.1 questions are grouped by the same domains. Each answer also carries the related ISO/IEC 27001:2022 Annex A control numbers, so it can be reused for SIG questionnaires, custom questionnaires and tender sections that are organised differently. Domain codes and names are cited for indexing only.

Questionnaires based on the Shared Assessments SIG (SIG Lite or SIG Core, current annual edition) group their questions into risk domains that differ from CCM. Keep a mapping sheet from SIG domain names to the codes above in the library tool. Do not copy SIG question text into this document: the SIG is a licensed product.

5. Answer record format

Each library entry has these fields. Mandatory fields are marked M.

A machine-readable export of one record (Example) helps when the library lives in a tool that feeds a trust centre or a questionnaire automation product:

{
  "answerId": "ANS-IAM-002",
  "topic": "MFA for workforce access",
  "domain": "IAM",
  "annexA": ["A.5.17", "A.8.5"],
  "status": "Yes",
  "shortAnswer": "Yes. MFA is enforced for all workforce access to production, the identity provider and the productivity suite.",
  "evidence": [{"id": "EVD-IAM-004", "tier": "T2"}],
  "sharingTier": "T0",
  "scope": ["Quillmere analytics platform"],
  "owner": "@it-lead",
  "lastReviewed": "2027-06-30",
  "nextReview": "2028-06-30"
}

6. Approved answers

6.1 Governance, certification and assurance (GRC, A&A)

6.2 Identity, access and people (IAM, HRS, UEM)

6.3 Data protection, cryptography and privacy (DSP, CEK, IPY)

6.4 Operations, development and resilience (AIS, CCC, LOG, TVM, SEF, BCR, IVS, DCS, STA)

7. Sharing tiers, evidence and NDA gating

Gating rules:

1. The responder checks the requester's tier before sending any answer or evidence. If the questionnaire asks for T2 material and no NDA exists, send the T1 answer with the line "Further detail is available under NDA" and start the NDA process (DOC-ISMS-051 or the customer's NDA after legal review).
2. Evidence is shared as a watermarked copy or through a data room with view logging. Record what was shared, with whom and when (section 13).
3. Every evidence item has an expiry date. Do not send a penetration test summary older than 15 months or a certificate copy that is not current.
4. Moving an item to a more open tier (for example from T3 to T2) needs the domain owner and legal counsel to agree.

8. Response workflow

Service levels (Example, set your own):

9. Questions without an approved answer

When a question has no approved answer:

1. The responder records it as a gap with the question topic (in their own words), the customer and the deadline.
2. The domain owner drafts an answer within the service level, checks it against the Statement of Applicability and the evidence matrix, and approves it into the library.
3. If the honest answer is "No" or "Partial" for a control the customer considers important, the owner tells the account owner and the library owner. The library owner decides whether it is a new risk for the risk register (DOC-ISMS-016) or an improvement for the continual improvement register (DOC-ISMS-088).
4. If the customer asks for a control the organization does not plan to implement, the answer says so plainly. A commercial decision to add the control is taken by management, recorded, and only then described as "Planned (date)".
5. Questions about a supplier's controls are answered with the supplier's assurance (certificate or report reference), not with the organization's own control description.

Common question patterns and how to handle them:

10. Review cadence and change triggers

11. Measures

12. Size tiers

13. Records and evidence

14. References

Related templates: isms/security-whitepaper-trust-center, isms/customer-security-addendum, compliance/statement-of-applicability, isms/control-evidence-matrix, isms/certification-mark-usage, isms/confidentiality-nda, isms/isms-policy-framework, compliance/supplier-security-assessment, compliance/soc2-controls, business/rfp-technical-response, legal-lite/subprocessor-list, legal-lite/dpa.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 + Amd 1:2024 clauses 7.4 and 7.5 and Annex A controls A.5.12, A.5.31 and A.5.34, with ISO/IEC 27002:2022 as guidance. The text, rules, workflow and example answers are original. Control numbers are cited with short descriptive labels; no ISO/IEC text is reproduced, and you need the official standards to implement the controls. The CSA Cloud Controls Matrix, CAIQ, Shared Assessments SIG and AICPA Trust Services Criteria are cited by name, version and domain only; no question or criteria text is copied. Check the current editions of every standard and questionnaire before use. Template licence: MIT.