The 10 questionnaires that delay enterprise procurement

• SIG Lite and SIG Core: the Shared Assessments standard used across financial services and large enterprises. Broad, deep, and heavily reused.
• CAIQ: the Cloud Security Alliance questionnaire, common for SaaS and cloud-native vendors.
• VSA: the Vendor Security Alliance questionnaire, favoured by technology buyers.
• Bespoke infosec questionnaires: internal spreadsheets built by the buyer, often overlapping SIG or CAIQ but reworded.
• GDPR and DPIA support requests: processor obligations, transfer mechanisms, and privacy impact inputs.
• DORA ICT third-party questionnaires: subcontractor detail, resilience testing, incident cooperation, exit planning.
• HECVAT: the higher education standard, used by universities and adjacent public sector buyers.
• AI risk questionnaires: model provenance, training data, evaluation, human oversight, and misuse controls.
• Business continuity and disaster recovery reviews: RTO, RPO, testing evidence, and dependency mapping.
• Financial crime and sanctions-adjacent reviews: screening, controls, and data handling for vendors touching regulated flows.

A useful library is not a folder of past responses. It is a structured store where each answer records the canonical response, the evidence that backs it, the owner, the last review date, and any known variants for specific buyer contexts.

Questions map to controls, not the other way around. If a control changes, every answer linked to it flags for review. If evidence is refreshed, every answer inherits the new link. This is the difference between a document and an operating system for questionnaires.

Automation here means structured reuse: matching new questions to library entries, suggesting a canonical answer, and surfacing the evidence and owner. It does not mean sending answers to a buyer without human review.

Guardrails matter. Auto-fill should be a draft, never a submission. A named reviewer signs off. An audit trail records who approved what, when, and against which evidence. That protects the vendor from stale answers and protects the buyer from false comfort.

Framework mapping accelerates the work. When a control is linked to SOC 2, ISO 27001, and internal policy, an answer built once serves multiple questionnaire families.

Proactive disclosure shortens cycles. A buyer evidence pack, a trust page with current attestations, and a pre-filled standard questionnaire tell procurement most of what they need before the bespoke sheet arrives.

Publish an internal SLA for questionnaire turnaround, name the owner, and track the metric. Deal desks and account teams stop chasing security when they can see when a response will land. Security stops firefighting when the library does the heavy lifting.