What Is a DDQ? Due Diligence and Security Questionnaires Explained

The deal has a verbal yes. Your champion is excited, legal has the order form, and then an email arrives from someone you’ve never met: “Before we can proceed, please complete our vendor due diligence questionnaire.” Attached is a spreadsheet with 14 tabs and 300 rows. The due date is Friday.

That spreadsheet is a DDQ. If you sell B2B software, raise money from institutional investors, or plan to be acquired one day, you will see a lot of them. Below: what a DDQ is, the standard versions you’ll run into, what they actually ask, how long they take, and how to answer one quickly without saying anything you’ll regret later.

What is a DDQ? The short answer

A DDQ (due diligence questionnaire) is a structured set of questions one organization sends another before it commits to a relationship: buying your software, investing in your fund or acquiring your company. It turns “can we trust you?” into a list of specific questions with written answers, and usually a request for evidence.

In B2B software, when people say DDQ they almost always mean the security DDQ, also called a security questionnaire, vendor security assessment or vendor risk assessment. It’s how an enterprise’s security team decides whether you can be trusted with their data before procurement signs.

Regulators expect buyers to do this. The NIST Cybersecurity Framework 2.0 says organizations should make sure “planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships” (control GV.SC-06, NIST CSF 2.0). US bank regulators put it more bluntly: “Due diligence in this area typically involves assessing the third party’s information security program” (Interagency Guidance on Third-Party Relationships, 2023). A questionnaire is the cheapest way to do that across hundreds of vendors, so that’s what lands in your inbox.

The three kinds of DDQ

The acronym gets used in three different worlds, and founders meet all three. The questions overlap more than you’d expect, especially on security.

1. The investor DDQ. Institutional investors (limited partners, or LPs) send these to fund managers (GPs) before committing capital. The industry template is the ILPA Due Diligence Questionnaire, which ILPA says is meant “to standardize the key areas of inquiry posed by investors during their diligence of managers.” Version 2.0 was last updated in 2021, and it has a whole section on cybersecurity. Question 18.1.1 asks: “Is the cyber/information security policy based on an internationally recognized standard (e.g., NIST or ISO 27001)?” Question 18.4 asks whether the firm has “an annual independent, third-party audit” of its security policy and controls (ILPA DDQ 2.0). Hedge funds have a parallel template from AIMA.

2. The M&A diligence request. When someone wants to buy your company, their team sends a long request list and opens a data room. Security is now a standard workstream, because buyers have learned what they inherit. When Marriott was fined over the Starwood breach, it told the UK regulator it had only been “able to carry out limited due diligence on Starwood’s systems and databases on acquisition,” and the regulator noted that due diligence “is not a time-limited or a one-off requirement” (Mayer Brown on the ICO’s Marriott decision). When we took Robust Intelligence through SOC 2 Type 2, they finished with zero deviations and closed their acquisition by Cisco four months later. A clean report is one less thing for an acquirer’s diligence team to dig into.

3. The vendor security questionnaire. This is the one that shows up mid-deal, every deal. An enterprise buyer’s security or third-party risk team sends it to you, the vendor. It’s the focus of the rest of this post.

Why buyers send them now

Buyers aren’t sending questionnaires to torture you. They’re sending them because vendors are now one of the most common ways companies get breached.

• Verizon’s 2025 Data Breach Investigations Report found that “third-party involvement in breaches has doubled to 30%,” across 12,195 confirmed breaches (Verizon DBIR 2025). In the 2026 edition, “third-party involvement in breaches has grown to 48%” (CIS on the 2026 DBIR).
• IBM’s 2025 Cost of a Data Breach report found supply chain compromise was the second most common attack vector, at 15% of breaches, and the slowest kind to find and contain, at 267 days (IBM report, hosted by Baker Donelson).
• In a 2026 ProcessUnity and Ponemon survey of 1,465 third-party risk practitioners, organizations averaged 12 third-party breaches or security incidents a year (ProcessUnity).

And the headlines keep giving them reasons:

Google Cloud / Mandiant · June 10, 2024UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion Help Net Security · June 20, 2024CDK Global cyberattack cripples 15,000 US auto dealerships Healthcare Dive · Jan. 27, 2025UnitedHealth hikes number of Change cyberattack breach victims to 190 million Google Cloud / GTIG · Aug. 26, 2025Widespread Data Theft Targets Salesforce Instances via Salesloft Drift

Look at what those incidents have in common. Mandiant found the Snowflake victims’ “impacted accounts were not configured with multi-factor authentication enabled.” The Salesloft Drift attackers came in “through compromised OAuth tokens” belonging to a third-party app. That’s why your next questionnaire will ask whether you enforce MFA everywhere, and which integrations hold tokens to customer data. If you’re building with AI agents, it’s also why we wrote Who Holds Your Agent’s Keys?: the token question is coming for agents next.

Regulation is pushing the same way. The EU’s DORA has applied to financial firms since January 17, 2025, and requires them to keep a register of every ICT vendor they rely on (EBA). New York’s cybersecurity regulation says third-party policies “must include guidelines for due diligence and contractual protections” (NYDFS). Public companies must now describe how they oversee risks “associated with its use of any third-party service provider” in their SEC filings (17 CFR 229.106). If your customer is a bank, an insurer, a hospital or a public company, someone above your reviewer is asking them to prove they checked you.

The standard security questionnaires

Most questionnaires you receive are either one of a handful of industry standards or a custom spreadsheet built from one. Recognizing the template tells you how big the job is and whether you can reuse an answer set you already have.

Questionnaire	Who maintains it	Size	Where you’ll see it
SIG Lite	Shared Assessments	About 128 questions (2025 edition)	Lower-risk vendors, first-pass reviews
SIG Core	Shared Assessments	About 627 questions across 21 risk areas (2025 edition)	Banks, insurers, large enterprises, critical vendors
CAIQ v4.1	Cloud Security Alliance	283 yes/no questions	Cloud and SaaS vendors; basis for a STAR Level 1 listing
AI-CAIQ (AICM v1.1)	Cloud Security Alliance	320 questions	AI products and model providers
HECVAT 4	EDUCAUSE, Internet2, REN-ISAC	Full, Lite and On-Prem merged into one file	Colleges and universities
VSA questionnaire	Vendor Security Alliance	VSA-Full and VSA-Core (adds privacy)	Tech companies; free to download
ILPA DDQ 2.0	Institutional Limited Partners Association	Dozens of pages, all topics	Fund managers raising from LPs
Custom spreadsheet	The buyer	Averages nearly 100 questions	Everyone else, which is most deals

Sources: SIG counts from Mitratech (Shared Assessments doesn’t publish counts publicly, and other vendors report different numbers); CAIQ from the CSA; AI-CAIQ from the CSA; HECVAT from EDUCAUSE; VSA from Vanta; custom average from SecurityPal.

A few things worth knowing about each:

SIG (Standardized Information Gathering) is the heavyweight. It’s versioned by year, and the scoping tool lets a buyer pick which risk areas to send you, so two “SIG Lites” from two banks may not match. If a financial services buyer sends you a SIG Core, budget real time for it.

CAIQ (Consensus Assessments Initiative Questionnaire) is the cloud world’s answer. The CSA describes it as “a set of Yes/No questions a cloud consumer and cloud auditor may wish to ask of a cloud provider” (CSA). It maps to the CSA’s Cloud Controls Matrix, now 207 controls across 17 domains. The useful part for a startup: you can fill it out once and publish it to the free CSA STAR Registry, which gives buyers something to read before they send their own.

HECVAT (Higher Education Community Vendor Assessment Toolkit) is mandatory reading if you sell into higher ed. Version 4, released in 2025, rolled the old Full, Lite and On-Premise versions “into one file,” added AI questions, and EDUCAUSE asks vendors to update theirs “at least once per year” (EDUCAUSE FAQ for vendors).

VSA came out of a 2016 coalition founded by Uber, Airbnb, Atlassian, Dropbox, Square and others “to streamline their vetting process for vendors’ cybersecurity risks” (Uber Newsroom). It’s shorter and more practical than SIG, and tech buyers like it.

Custom spreadsheets are the most common and the most annoying, because the questions are phrased slightly differently every time. The good news is that underneath, they ask the same 100 or so things. Once you’ve answered a SIG Lite and a CAIQ well, you can answer almost anything.

What a security DDQ actually asks

Strip away the formatting, and almost every security questionnaire covers the same territory. Here’s what to expect, with the kind of question you’ll see and the evidence that answers it best.

Area	A typical question	Best evidence
Governance	Who is responsible for information security? Is your policy approved and reviewed annually?	Named owner, policy set with review dates
Access control	Is MFA enforced for all workforce and admin access? How often do you review access?	SSO/MFA config, quarterly access review records
Encryption	Is customer data encrypted at rest and in transit? Who manages the keys?	Architecture notes, cloud KMS settings
Change management	Are code changes reviewed and approved before production?	Branch protection, CI/CD controls, SOC 2 CC8.1 testing
Vulnerability management	When was your last third-party penetration test? How fast do you fix criticals?	Pentest summary letter, patch SLAs
Logging and monitoring	Do you centrally log and alert on security events? How long do you keep logs?	SIEM or log pipeline, retention settings
Incident response	Do you have a tested incident response plan? How quickly will you notify us?	IR plan, tabletop record, contract notice terms
Business continuity	What are your RTO and RPO? Are backups tested?	BC/DR plan, restore test results
Vendors	Which subprocessors handle our data? How do you assess them?	Subprocessor list, your own vendor reviews
People	Do employees get background checks and security training?	HR process, training completion records
Privacy	Where is data stored? Do you support deletion requests? Are you GDPR-ready?	DPA, data map, privacy policy
AI	Do you train models on our data? Which model providers do you use?	AI policy, model inventory, ISO 42001
Compliance	Do you have a SOC 2 Type 2 or ISO 27001? Can we see it?	The report itself, under NDA

If you’re early and many of those rows are blank, that’s normal. Our free SOC 2 readiness checklist walks through the same territory in about four minutes and shows you which gaps buyers will find first.

The new AI section

A year ago, AI questions were a stray line or two. Now they’re a full tab, and they’re the questions founders are least ready for.

The standards bodies have caught up. The Cloud Security Alliance’s AI Controls Matrix v1.1 has “247 control objectives across 18 domains,” and its companion AI-CAIQ “has been updated to 320 questions” (CSA, July 2026). HECVAT 4 added AI-specific questions. The financial sector’s FS-ISAC published a Generative AI Vendor Evaluation and Qualitative Risk Assessment tool in February 2024, covering data privacy and retention, model training, information security, integration, and what it calls “Nth party risk”: your vendors’ vendors.

Expect questions like these:

• Do you use our data to train or fine-tune models? Can we opt out?
• Which foundation models and providers do you use, and where do they run?
• How long are prompts and outputs retained, and who can see them?
• How do you defend against prompt injection?
• What can your AI features or agents access, and can they write, or only read?
• Do you have an AI governance framework, such as ISO 42001?

That fifth question is the one sophisticated buyers care about most. I asked Yash Kosaraju, the CISO of a16z, how his team reviews AI tools on episode 104 of our podcast. His answer: the usual checklist is table stakes, and the real review is about reach.

If you can answer “what can it reach, and can it write?” for every AI feature and agent in your product, you’re ahead of most vendors. We’ve written about how to do exactly that in Are You Actually Going to Give the Agent Write Access? and Shadow AI governance. If AI is central to what you sell, ISO 42001 is fast becoming the certification that answers this whole tab at once: our Augment Code case study shows what that looks like in practice.

How long a DDQ takes, and what it costs

Longer than anyone budgets for. Most of the numbers come from vendors who sell questionnaire tools, so read them as directional, but they point the same way:

• Per questionnaire: Whistic’s survey of more than 600 security and sales professionals found vendors were “responding to 23 vendor assessment requests each month on average,” with “each response taking around 3.5 hours” (Whistic, 2022). Vanta, drawing on customer conversations, puts it at 5 to 15 hours per review (CSA).
• Per year: Vanta’s 2025 State of Trust survey of 3,500 business and IT leaders found teams spend about 9 working weeks a year on vendor security reviews and risk assessments, up from 7, and 61% “spend more time proving security rather than improving it” (Vanta, October 2025).
• On deals: In Whistic’s survey, 45% of respondents had a deal pushed because they couldn’t answer a security review in time, and 34% lost one. A review “can add up to a week before the deal is closed.”
• On the buyer’s side: In the ProcessUnity survey, 27% of vendors “fail to respond to assessments at all,” and 60% of organizations said vendor responses take “four months to more than 12 months.”

That last stat is your opportunity. If a quarter of vendors never answer and most take months, the vendor who sends back a clean, accurate response in a week stands out.

Here’s a rough way to size the work for your own company:

Your questionnaire load

How many hours a year are security questionnaires taking from your team?

Tell us roughly how many security reviews you see in a year, what kind of questionnaire is typical, and how ready your answers are. The math is simple and shown below the numbers.

Typical questionnaire Custom spreadsheet, about 100 questions SIG Lite, about 128 questions CAIQ v4.1, 283 questions SIG Core, about 627 questions Security reviews per year Loaded cost of the person answering (USD per hour) How ready are your answers today? Starting from scratch each time We copy from past answers We keep a reviewed answer library

…hours per questionnaire

…hours a year on questionnaires

…working weeks of someone's year

…loaded cost a year, before follow-ups and calls

Send me a plan to cut this down →

A person on our Sales Support team reads this, looks at your numbers, and replies with what we'd fix first. No sequence, no vendor pitch.

The biggest hidden cost isn’t on that calculator. It’s whose time it is. At most startups, the questionnaire goes to the most senior engineer who knows the infrastructure, and that person stops shipping for a week. We break down that trade-off in In-House, On-Demand, or YOLO? and in SOC 2 when you’re not ready to hire.

What a SOC 2 replaces, and what it doesn’t

The single best way to shrink a questionnaire is to have an audit report the buyer trusts. EDUCAUSE says it directly in its guidance to vendors: “Most colleges and universities will accept a recent SOC2 Type 2 report” in place of the HECVAT, and “many institutions will consider alternate documentation, such as the CAIQ” (EDUCAUSE). Bank regulators tell examiners the same thing from the other side: a bank “may consider reviewing System and Organization Control (SOC) reports” as part of due diligence (Interagency Guidance).

In practice, a recent SOC 2 Type 2 lets you answer whole sections with “See our SOC 2 report, section X,” and many reviewers are happy with that. It’s also why the type matters. A Type 1 shows your controls were designed right on one day; a Type 2 shows they worked for months, which is what the reviewer is really trying to learn. We cover the difference, and the costs, in SOC 2 Type 1 vs Type 2. If you’re starting from zero, read What Even Is a SOC 2? first.

What a SOC 2 doesn’t cover, and where questionnaires still dig:

• Anything outside your scope. Bitsight’s guide for reviewers is blunt: “If the product you buy is not clearly named in the system description, the report does not cover it” (Bitsight).
• Anything after the audit period. A report can’t speak to changes since the window closed. That’s what a bridge letter is for.
• AI, privacy specifics, subprocessors, insurance and product details. These sit outside most SOC 2 reports and come back as questions.
• Whether the report is any good. Reviewers have learned that not all SOC 2s are equal. They now check who signed it and how thorough the testing was. See Is Your SOC 2 Real? for what they look for.

How to answer a DDQ, step by step

Here’s the process we run for clients every week. It works for a custom spreadsheet, a SIG or a fund DDQ.

1. Confirm the scope before you start. Ask the buyer which product, which data and which deadline. Ask whether they’ll accept your SOC 2 report, a standard questionnaire you’ve already completed, or your trust center in place of some or all of it. A surprising number say yes. Ask, too, whether there’s a shorter version for lower-risk vendors.

2. Name one owner. Somebody has to drive it to done: route questions, chase engineers and do the final review. Questionnaires with no owner are the ones that sit for three weeks.

3. Answer from a library, not from memory. Keep a single, reviewed set of answers to the common questions, with the date each was last checked and who approved it. Start one with your first questionnaire. By the fifth, most of the work is copying and checking. Every questionnaire platform, including Vanta, Drata, Conveyor, Loopio and others, is built around this idea.

4. Answer precisely, and qualify honestly. “Yes” is only the right answer if it’s true everywhere, all the time. If MFA is enforced on everything except one legacy admin console you’re migrating, say that, and say when the migration finishes. Reviewers trust a precise “partially, here’s the plan” far more than a blanket “yes.” It also prevents the follow-up round.

5. Attach evidence instead of writing essays. Point to your SOC 2 section, your pentest summary letter, your policy, your subprocessor list. Short answers plus evidence beat long answers with none.

6. Read the contract terms that come with it. Questionnaires increasingly arrive with a security addendum: breach notification windows, audit rights, data location, insurance minimums. Your questionnaire answers often get attached to the contract. Make sure they match what legal is signing.

7. Offer a call. When a reviewer has more than a handful of follow-ups, a 30-minute call with someone who can speak as a peer to their security team usually closes it faster than another email round. That’s a big part of what a vCISO does for a startup.

8. Publish what you can. A trust center with your certifications, policies, subprocessors and a pre-filled CAIQ or SIG Lite lets buyers serve themselves. The CSA describes it as “a centralized resource, such as an externally-facing website or portal” that shares an organization’s “data security, privacy practices and policies” (CSA). Publishing your CAIQ to the STAR Registry does something similar for free.

If you only remember one script, make it the one for a question you can’t answer yet. We wrote it out word for word, along with what enterprise buyers ask for and in what order, in the free Founder’s Security Cheat Sheet.

A word on AI-written answers

AI tools are now very good at drafting questionnaire answers. Vanta says its AI automates “over 80%” of responses, and Conveyor says its AI answers “over 90% of customer security questions” (Vanta, TechCrunch on Conveyor). Both are vendor claims, and both depend on having good source material to draw from. Use them. But notice that Vanta’s own workflow has your team “review, approve, and submit” (Vanta), and for good reason: an AI draft that confidently says “yes” to a control you don’t have is still your company’s answer.

Why accuracy matters more than speed

Buyers already doubt what they read. In a RiskRecon and Cyentia survey of 154 third-party risk professionals, “only 14% of surveyed professionals report being highly confident in the accuracy of vendor questionnaire responses” (Business Wire). That doubt is why reviewers ask for evidence, and why an answer that later turns out to be wrong does lasting damage.

The stakes can go beyond the deal. The US Department of Justice launched its Civil Cyber-Fraud Initiative in 2021 to pursue companies “knowingly misrepresenting their cybersecurity practices or protocols,” using the False Claims Act. The cases so far involve government contracts, but the pattern is a warning for anyone filling out a questionnaire:

• Aerojet Rocketdyne paid $9 million in 2022 to resolve allegations of “misrepresenting its compliance with cybersecurity requirements in certain federal government contracts” (DOJ).
• Illumina paid $9.8 million in 2025 over allegations that it “falsely represented that the software on the genomic sequencing systems adhered to cybersecurity standards, including standards of the International Organization for Standardization and National Institute of Standards and Technology” (DOJ).
• Georgia Tech Research Corporation paid $875,000 in 2025 over a cybersecurity score the government alleged was based on a “fictitious” environment rather than a real system (DOJ).
• In fiscal 2025 alone, DOJ recovered “more than $52 million across nine cybersecurity-related FCA settlements” (Mayer Brown).

In each case, DOJ notes the claims are allegations only and there has been no determination of liability. Separately, the SEC’s case against SolarWinds and its CISO rested in part on security statements posted on the company’s website before the breach. The court narrowed the case in 2024, and the SEC dismissed it in November 2025 (Covington), but it showed that public security claims can be read as representations.

None of this means you should be afraid of questionnaires. It means “we’re working on it” is a perfectly good answer, and an optimistic “yes” isn’t. Write what’s true, say what’s in progress, and keep the date on every answer. SolarWinds’ CISO Tim Brown put the lesson this way after his case ended: “Normal operating procedures became proof, from [the SEC’s] perspective, of negligence” (TechTarget). As we wrote in our vCISO guide, the answers in your security questionnaires are part of that record too.

(I’m not a lawyer, and this isn’t legal advice. If a questionnaire answer is going into a contract with real liability attached, have your counsel read it.)

DDQ vs RFP vs security questionnaire vs SOC 2

These get mixed up constantly, including by the people sending them.

	What it is	Who sends it	What you send back
DDQ	Any due diligence questionnaire: investor, M&A or vendor	LPs, acquirers, enterprise buyers	Written answers plus documents
Security questionnaire	The security-focused vendor DDQ	A buyer’s security or third-party risk team	Answers, evidence, sometimes a call
RFP	A request for proposal to compare vendors on product, price and terms, often with a security section	Procurement	A proposal, usually before a short list
SOC 2 report	An independent CPA firm’s attestation of your controls	You send it, under NDA	The report itself, which answers many questionnaire rows
Trust center	Your public or gated page of security documentation	You publish it	Self-serve access for buyers before they ask

The short version: the RFP decides whether you’re on the short list. The security questionnaire decides whether the deal clears security review. The SOC 2 and trust center are how you make the questionnaire shorter.

The short answer to “What is a DDQ?”

A DDQ is the moment a buyer, an investor or an acquirer stops taking your word for it and asks you to write it down. In B2B software that’s usually a security questionnaire, and it usually lands after the champion says yes and before procurement signs, which is the worst possible time for a deal to slow down.

The companies that move through them quickly aren’t the ones with perfect security. They’re the ones with a named owner, a reviewed answer library, a recent SOC 2 to point to, and someone who can get on the phone with the buyer’s CISO.

That’s what our Sales Support team does. We join your Slack, answer SIGs, CAIQs, HECVATs and custom DDQs as your security team, take the calls, and work the security terms with your counsel until the deal clears review. When you need the report behind the answers, the same team runs SOC 2 Type 2, ISO 42001 and the penetration test buyers ask for. Our clients hold a 99% audit pass rate, and we bill in 15-minute increments with no retainers or minimums.

Is a questionnaire sitting in someone’s inbox right now? Book a free 15-minute call and send it over, or grab the free Founder’s Security Cheat Sheet for the exact words to use while it’s in progress. If you’re a startup, claim your first 8 hours free.