Security questionnaires and DDQs
Which software can answer SIG and CAIQ questionnaires?
Short answer
15 tools in this directory name SIG or CAIQ handling in their recorded evidence: Inventive AI, Conveyor, Iris, SiftHub, Skypher, Wolfia and 9 more. If your buyers send the full SIG, test the tool on that exact year and tab layout, because a format name on a feature page is a claim about support, not about how clean the export is.
Tools that qualify, with the evidence
| Tool | Evidence | Source | Starting price |
|---|---|---|---|
| Inventive AI | Handles SIG and SIG Lite, CAIQ, VSAQ, VSA, NIST 800-171, CIS Controls, ISO 27001 and SOC 2 questionnaires in Excel, Word, PDF or buyer portals, with a governance agent catching expired certs. | inventive.aias of Oct 2026 | $10,000/yr |
| Conveyor | Automatic parsing of SIG (Lite or Core), HECVAT (v3, v4) and CAIQ (v3, v4, AI-CAIQ v1) files as AI sources expects the original Shared Assessments, EDUCAUSE or Cloud Security Alliance layout. | docs.conveyor.comas of Oct 2026 | Custom |
| Iris | Handles CAIQ, SIG, SIG Lite and buyer Excel sheets with evidence attached, and a browser extension fills ProcessUnity, OneTrust, Vanta and other web portals in place. | heyiris.aias of Oct 2026 | Custom |
| SiftHub | Auto-fills SIG, VSAQ, CAIQ, VSA, NIST 800-171, CIS Controls, SOC 2 and ISO 27001 questionnaires plus custom Word, Excel and PDF formats. | sifthub.ioas of Oct 2026 | Custom |
| Skypher | Knowledge base organised by ISO 27001, SOC 2 Type II, NIST and SIG, with automated review cycles, duplicate detection and continuous sync from internal wikis, SharePoint, Google Drive and Notion. | skypher.coas of Oct 2026 | Custom |
| Wolfia | RFPs are accepted as an input alongside SIG files, but the product is built around security questionnaires rather than proposal writing. | wolfia.comas of Oct 2026 | Custom |
| SecurityPal | Questionnaire Concierge accepts DDQs alongside SIG and CAIQ, and the demo form offers "Security Questionnaires & DDQs". | securitypalhq.comas of Oct 2026 | Custom |
| Realm | It answers security questionnaires and vendor assessments (including CAIQ and SIG formats) and DDQs alongside RFPs and RFIs, with cited sources on every answer. | withrealm.comas of Oct 2026 | Custom |
| RequestFX | The security page covers SIG, CAIQ, HECVAT and buyer-custom sheets, rebuilding the buyer's original file including tabs and conditional sections. | requestfx.comas of Oct 2026 | $299/mo |
| Sequesto | Parses SIG, CAIQ and custom security questionnaires from Excel, Word or PDF and drafts each row from the Knowledge Hub with citations and a confidence score. | sequesto.comas of Oct 2026 | €750/mo |
| TrustCloud | TrustShare, part of the TrustCloud GRC platform, pairs a live trust portal with AI questionnaire completion; assessments import via white-glove service, a self-serve template or SIG, CAIQ and VSA templates. | community.trustcloud.aias of Oct 2026 | Custom |
| Velocibid | Positioned for security questionnaires and custom spreadsheets SOC 2, CAIQ, SIG Lite, ISO 27001, HECVAT. | velocibid.comas of Oct 2026 | $49/mo |
| Thalamus AI | The security questionnaire page names CAIQ, SIG and NIST-based assessments and says a browser extension completes questionnaires inside portals such as OneTrust, SecurityScorecard, Prevalent and Archer. | thalamushq.aias of Oct 2026 | Custom |
| Savix | The technology industry page describes answering SIG Lite, CAIQ, VSAQ and custom Excel questionnaires from an uploaded compliance library. | savix.ioas of Oct 2026 | $99/mo |
| ContraVault AI | Teams with a steady flow of SIG or DDQ requests should pair it with a questionnaire tool. | contravault.comas of Oct 2026 | Custom |
Why this question matters
SIG (from Shared Assessments) and CAIQ (from the Cloud Security Alliance) are the two standard security questionnaires most vendors see. Both arrive as large spreadsheets with fixed structures, so the useful question is whether a tool keeps that structure intact while it fills answers in.
Which one fits your situation
- If you also get custom questionnaires in buyer portals, start with Inventive AI, Conveyor and Iris.
- If you need every answer tied to a visible source, start with Inventive AI, Conveyor and Iris.
What to test in a trial
- Use your last completed SIG Lite or CAIQ as the benchmark and an unseen copy as the test.
- Check that dropdown cells, comment columns and tab order survive the round trip.
- Ask which SIG year the vendor tests against, then try the version your buyers actually send.
Caveats
- Not every tool names formats publicly. A tool missing from this list may still handle SIG files; it just has not documented it in a way we could source.
- Format support moves between product releases, so check the dates in the source column.
How we decided who qualifies
Only RFP, DDQ and questionnaire response tools with a published profile are checked. A tool is named here only when its record shows the rule above, either in a sourced research fact or in the reviewed profile, and we publish an answer only when at least three tools qualify. A tool missing from the table may still do this; it has not been documented in a way we could source. Read the research methodology for how facts are dated and corrected.
More questions on this topic
What is the difference between SIG and CAIQ?
SIG is a broad third-party risk questionnaire that covers many control areas. CAIQ is narrower and maps to the Cloud Controls Matrix, so it is common for SaaS and cloud vendors.
Can a tool pre-fill a SIG from a SOC 2 report?
Some tools draft answers from uploaded reports and policies. Treat those drafts as suggestions until a security owner confirms each one against the current report.
Is SIG Lite enough for most buyers?
That depends on the buyer. Many accept SIG Lite for lower-risk vendors and ask for the full SIG for anything touching sensitive data.