“If we’ve already done the security questionnaire, why are they asking security questions in the RFP?” A solutions engineer asked us that last month. It’s a fair question. Security questionnaires and RFPs overlap but serve different purposes. Here’s how they relate and what to expect when both show up.
Quick Answer
An RFP is a broad request for a full proposal (solution, commercial terms, implementation). A security questionnaire (e.g., SIG, CAIQ, custom) focuses specifically on security, privacy, and compliance. They often appear together: the RFP may embed security questions, attach a questionnaire, or reference one you’ve already completed. Treat security questionnaire responses as evidence you can cite in the RFP - but don’t assume the RFP will accept “see our SIG” instead of a direct answer unless they say so.
What Is a Security Questionnaire?
Security questionnaires are structured surveys about your security posture. Common types:
- SIG (Standardized Information Gathering) - Industry-standard, comprehensive
- CAIQ (Consensus Assessments Questionnaire) - Cloud-focused, from CSA
- Custom questionnaires - Buyer-specific, often based on SIG or internal requirements
They typically cover: access control, encryption, incident response, vendor management, compliance (SOC 2, ISO 27001, etc.), and data handling.
How RFPs and Security Questionnaires Connect
| Scenario | What to do |
|---|---|
| Security section in the RFP | Answer in the RFP. You can reference your SIG/CAIQ as evidence. |
| RFP references “complete attached SIG” | Complete the questionnaire and submit as part of the RFP package. |
| RFP says “SIG on file” or “CAIQ acceptable” | If you have a current SIG/CAIQ, you may be able to submit it. Confirm with the buyer. |
| Separate security questionnaire, same deal | Complete both. They may be evaluated by different teams (procurement vs security). |
A procurement lead we spoke with put it this way: “The RFP gets you to the table. The security questionnaire gets you past our infosec team. We need both.”
Practical Approach
- Maintain a master security answer set - SIG, CAIQ, and common RFP security questions. Update quarterly.
- Map RFP security questions to your master set - Most questions repeat. Reuse and customize.
- Cite evidence - “We are SOC 2 Type II certified (report available under NDA). See Question 4.2 in attached SIG.”
- Don’t assume reciprocity - Completing a SIG for one deal doesn’t mean another buyer will accept it. Check each RFP.
- Watch for conflicts - If the RFP asks something that contradicts your SIG (e.g., different data residency answer), resolve it before submitting.
Common Misconceptions
| Misconception | Reality |
|---|---|
| “SIG replaces RFP security questions.” | Only when the buyer explicitly says so. Otherwise, answer both. |
| “All security questionnaires are the same.” | SIG, CAIQ, and custom forms differ. Map each to your master set. |
| “Security is only in the questionnaire.” | Many RFPs have their own security section plus a questionnaire. |
| “Once we complete SIG, we’re done.” | SIG should be kept current. Buyers expect recent completion dates. |
Frequently Asked Questions
Q: Can we submit an old SIG?
Buyers often want a SIG completed within the last 12 months. Check the RFP or questionnaire instructions.
Q: What if the RFP security questions contradict our SIG?
Clarify with the buyer. You may have updated controls or a different interpretation. Don’t submit conflicting answers.
Q: Do we need a separate security team to complete these?
Often yes. Security questionnaires are detailed. Involve infosec or compliance early.