Tools
Security questionnaire pre-fill
Start a vendor review with the questionnaire already answered where the public record allows: the vendor’s own published CAIQ, AI-CAIQ or HECVAT answers, matched by question ID, then dated public evidence. You send the vendor only the gaps.
Pick a vendor and a questionnaire. You get every question with the vendor’s published answer or the public evidence behind it, dated and linked, and the rows that still need the vendor.
Coverage is free to check. Answers and exports are part of Buyer Team.
The vendor's own answers first
CSA STAR Level 1 listings and public trust-centre files carry the vendor’s CAIQ or HECVAT. Answers are taken as published, by question ID and version, with the date and a link.
Then dated public evidence
SOC 2 and SOC 3 reports, ISO certificates, published plans and the vendor’s own statements answer the questions they are squarely about. Nothing about internal practice is inferred.
The gaps, listed for the vendor
Rows the public record cannot answer say so. Export the questionnaire and send it back with only those rows open.
Questions about pre-fill
Where do the answers come from?
First from the vendor's own published questionnaire: CSA STAR Level 1 listings carry the vendor's CAIQ, and many trust centres publish a CAIQ or HECVAT. Answers are matched by official question ID and version. Where the vendor has not answered a question publicly, CertReports uses dated public evidence for the question's topic, such as a SOC 2 or SOC 3 report, a published business continuity plan or the vendor's own statement on encryption.
Does it ever answer "No" for the vendor?
No. A missing record is not a "No". Rows the public record cannot answer are marked "Not in the public record" and listed for the vendor, so you only ask about the gaps.
Can I pre-fill a SIG Lite?
Yes, by uploading your own copy. SIG content is licensed by Shared Assessments, so CertReports does not ship it; your file is read to match each question to the public evidence and returned with four pre-fill columns added. In-house questionnaires work the same way.
Is my uploaded questionnaire stored?
No. The file is read in memory to pre-fill it and to build your export, then discarded.
Which versions are supported?
CAIQ v4.0.x and v4.1 and AI-CAIQ v1.0 from the Cloud Security Alliance, HECVAT 4 from EDUCAUSE, and any .xlsx or .csv with the questions in one column. CAIQ v4.1 renumbered part of the catalogue, so answers are only matched between the same major and minor version.
CAIQ and AI-CAIQ are published by the Cloud Security Alliance; HECVAT by EDUCAUSE; SIG by Shared Assessments. CertReports shows question IDs only and is not affiliated with them. How CertReports decides states.