Home › Free tools › Questionnaire answers
The fourth security questionnaire is the one that breaks you, because it asks the same eighty things as the first three in different words. This keeps your answers once, against the control topics questionnaires actually ask about, then reads the workbook a customer sent you and fills what it can, flags what it is unsure about, and lists what you have never answered. It reads .xlsx in the browser, so the file your customer emailed goes in untouched, and nothing leaves this tab.
Runs in your browser. Nothing is sent anywhereAn Excel workbook or a CSV, exactly as it arrived. It is read in this tab and never uploaded. If you would rather not open a file at all, paste the questions in below instead.
The columns below were worked out by looking at the contents: the question column is the one that reads like questions. Correct any of it.
Every row, in the order it appeared. Press one to see which words it matched on, and to edit the stored answer without leaving the page.
The answer column is in the same row order as the file, so it pastes straight down the column. An empty line is a question this had nothing for, so your own text stays where it is.
Correct these once and every questionnaire after this one gets easier. An answer in square brackets is one nobody can write for you, and is counted as unanswered until you do.
Your library is held in this browser's local storage on this device and is never transmitted. Keep a copy: a browser profile is not a backup, and this is an hour of your writing.
No, and it cannot. SIG and SIG Lite are licensed products of Shared Assessments, whose terms state that questions may not be edited and that adding, removing or reformatting rows and columns needs their written consent. The Cloud Security Alliance publishes the CCM and CAIQ under its own licensing regime covering commercial use and customisation. Shipping either one's question text inside a free tool would be a licence breach, so this ships neither. You bring your own copy of whatever questionnaire you were sent, which you are entitled to have, and this matches its questions to your answers.
It holds control topics rather than questions. Each of the topics carries the vocabulary a questionnaire tends to use when it asks about that control, and an incoming question is scored against all of them. That is why it works on a bespoke customer spreadsheet as well as on a standard form, which a tool built around one questionnaire's exact wording does not.
It says so rather than guessing. A question that matches nothing is listed as a gap with no answer filled. A question whose best match is not clearly ahead of the runner-up is filled but flagged for you to check, and you can see which words it matched on and what the alternative was. A wrong answer in a security questionnaire is worse than a blank one: a blank gets queried, and a wrong one gets believed and then contradicted by your evidence.
No. The workbook is opened with the browser's File API and read in the page. A completed questionnaire is a map of your security posture and, half the time, of your customer's procurement process, which is not a document to hand to a third party in order to fill it in. Your library is held in this browser's local storage on this device and nowhere else.
An .xlsx file is a ZIP archive of XML. The archive is walked in the page and its parts are decompressed with DecompressionStream, which browsers provide natively, then the XML is read with the browser's own parser. No library is loaded, which is also why it works under this site's content security policy.
No. Every topic arrives with a starting answer written for a small software company, which you correct rather than compose. Some deliberately contain a bracketed instruction instead of an answer, because nobody can guess your hosting region or whether you hold a SOC 2, and a plausible invention there is worse than a blank. It also reads the answers you have already written in the incident response plan builder, the vendor register and the record of processing on this device.
Treat them as a first draft by someone who has seen a lot of these, not as truth about your company. Several are deliberately wrong for you. The value is that correcting a sentence takes a minute and writing one from nothing takes twenty, and that the library then stops you answering the same thing three different ways across three questionnaires, which is what actually loses trust.