Standard questionnaires & frameworks

The questionnaires and frameworks buyers ask for in each industry, with links to the official sources.

Buyers often expect answers in a familiar format. Instead of a new form, use the standard your buyers already know — these links go to the official source (some require free registration or a licence).

  1. 1 Reference the standard. Download a blank or sample questionnaire, or read the framework, from the links below.
  2. 2 Fill it out externally. Or use a sheet, report or certificate you have already completed.
  3. 3 Upload it to the Evidence Vault and link it to a section. It joins the evidence register of your next approved, signed profile version.

Questionnaires & prequalification

  • CSA CAIQ v4
    Consensus Assessments Initiative Questionnaire — yes/no questions mapped to the Cloud Controls Matrix, for cloud and SaaS providers.
  • SIG Lite / SIG Core
    Shared Assessments Standardized Information Gathering questionnaire — the common general vendor-risk questionnaire, with a Financial Services profile.
  • VSA questionnaire
    Vendor Security Alliance questionnaires (VSA Full / VSA Core) for assessing software and service vendors.
  • HECVAT
    Higher Education Community Vendor Assessment Toolkit — used by universities and academic health systems.
  • PPAP
    Production Part Approval Process — AIAG submission package customers ask manufacturing suppliers for.
  • Achilles UVDB / FPAL
    Supplier prequalification questionnaires used by utilities (UVDB) and the offshore energy sector (FPAL).
  • ISNetworld
    Contractor prequalification platform: safety programs, insurance and regulatory data reviewed for operators.
  • Avetta
    Contractor and supplier prequalification questionnaires for safety, insurance and sustainability.
  • ComplyWorks
    Contractor compliance and prequalification forms, common with Canadian operators.

Frameworks & standards

  • SOC 2 Type II
    AICPA attestation over security, availability, confidentiality, processing integrity and privacy controls over a period.
  • SOC 1
    AICPA report on controls relevant to customers' financial reporting — common for financial-services vendors.
  • ISO/IEC 27001
    Certifiable information security management system (ISMS) standard.
  • NIST CSF
    NIST Cybersecurity Framework — Govern, Identify, Protect, Detect, Respond, Recover. A common way to frame a security program.
  • PCI DSS
    Payment Card Industry Data Security Standard — required wherever cardholder data is stored, processed or transmitted.
  • CyberSecure Canada (CAN/DGSI 104)
    Federal certification of baseline cyber security controls for small and medium-sized organizations.
  • NERC CIP
    North American Critical Infrastructure Protection reliability standards for the bulk electric system.
  • GDPR
    EU General Data Protection Regulation — the benchmark for mapping data processing terms, lawful bases and transfers.
  • PIPEDA
    Canada's federal private-sector privacy law, with guidance from the Office of the Privacy Commissioner.
  • OSFI B-10 / B-13
    OSFI guidelines on third-party risk management (B-10) and technology and cyber risk management (B-13) for Canadian federally regulated institutions.
  • EU DORA
    Digital Operational Resilience Act — ICT risk, incident reporting, resilience testing and ICT third-party risk for EU financial entities.
  • AML / KYC baselines
    Anti-money-laundering and know-your-customer obligations; in Canada set out by FINTRAC.
  • HIPAA Security & Privacy Rules
    US rules for protecting health information; buyers often send HIPAA security evaluation templates.
  • ISO 13485
    Quality management system for medical device design and manufacture.
  • Health Canada / FDA device approval
    Medical device licensing in Canada and US FDA clearance or approval.
  • EU MDR / IVDR
    EU Medical Device and In Vitro Diagnostic Regulations.
  • ISO 9001
    Certifiable quality management system standard, recognized across every industry.
  • IATF 16949
    Automotive quality management system requirements, built on ISO 9001.
  • AS9100
    Aerospace, space and defence quality management system standard (IAQG).
  • REACH
    EU regulation on registration and restriction of chemicals in products.
  • RoHS
    EU directive restricting hazardous substances in electrical and electronic equipment.
  • ISO 14001
    Certifiable environmental management system standard.
  • ISO 50001
    Energy management system standard.
  • ISO 45001
    Occupational health and safety management system standard.
  • OGMP 2.0
    UNEP Oil & Gas Methane Partnership reporting framework for methane emissions.
  • API standards
    American Petroleum Institute standards for equipment, operations and safety.
  • TAPA FSR / TSR
    Transported Asset Protection Association security requirements for facilities (FSR) and trucking (TSR).
  • CTPAT
    US Customs-Trade Partnership Against Terrorism supply-chain security program.
  • Partners in Protection (PIP)
    CBSA's Canadian trusted-trader supply-chain security program.
  • Good Distribution Practice (GDP)
    Guidelines for storing and transporting medicinal products (EudraLex).
  • ISO 28000
    Security management systems for the supply chain.
  • ISO/IEC 20000-1
    Certifiable IT service management system standard.
  • Professional licensing
    Licences from professional bodies — CPA, P.Eng / engineering regulators, law societies — held by the firm or its people.
  • Government security clearances
    Organization and personnel clearances (e.g. Reliability, Secret) required for public-sector work.
  • COR (Certificate of Recognition)
    Canadian safety program certification issued through provincial construction safety associations.
  • OSHA standards
    US occupational safety and health standards, including construction-specific rules.
  • LEED
    Green building rating system — project and professional credentials.
  • Bonding & insurance verification
    Surety bonding capacity and insurance certificates, usually requested during prequalification.
NextApprovals & publishing