Frameworks

SOC 2, SIG Lite, CAIQ, HECVAT and VSA: what each one asks for and how a small SaaS team can complete it.

• Oct 19, 2026 · 7 min read

  MFA and access control questions in security questionnaires: how to answer them

  How to answer MFA, SSO, access review and offboarding questions in a security questionnaire, with example answers, honest wording for gaps and a checklist.

• Oct 17, 2026 · 7 min read

  “Do you have an incident response plan?” How to answer it in a security questionnaire

  How to answer incident response and breach notification questions in a security questionnaire, with example answers, what to avoid, and a one-page plan.

• Oct 16, 2026 · 6 min read

  AI questions in security questionnaires: how to answer them when you've shipped an AI feature

  Buyers now ask how your AI features handle their data. The common AI questionnaire questions, example answers you can adapt, and the traps that cause rework.

• Oct 15, 2026 · 4 min read

  SOC 2 bridge letter: what it is and how to write one

  A buyer asked for a SOC 2 bridge letter. What it covers, who signs it, how long a gap it can bridge, and a plain example you can adapt for your company.

• Oct 14, 2026 · 6 min read

  “Have you had a penetration test?” How to answer when you haven’t

  The penetration test question shows up in most security questionnaires. Here is how to answer honestly if you haven't had one, and what to offer instead.

• Oct 12, 2026 · 5 min read

  The VSA questionnaire explained: what it asks and how to complete it without a security team

  What the Vendor Security Alliance (VSA) questionnaire is, VSA Core vs Full, the questions it asks section by section, and how a small SaaS team can answer them.

• Oct 4, 2026 · 2 min read

  SIG Lite questionnaire: what it is and how to complete it without a security team

  What the Shared Assessments SIG and SIG Lite are, how they differ from SIG Core, and a practical way for a small SaaS team to complete one.

• Oct 4, 2026 · 3 min read

  The CAIQ questionnaire explained: how to fill out the Cloud Security Alliance’s questionnaire

  What the CAIQ is, how it relates to the Cloud Controls Matrix and the STAR Registry, and a practical way for a small SaaS team to complete it.

• Oct 4, 2026 · 2 min read

  HECVAT for SaaS vendors selling to universities: a practical guide

  What the HECVAT is, what changed in HECVAT 4, and how a small SaaS company can complete it for a college or university customer.

• Oct 3, 2026 · 3 min read

  "Do you have a SOC 2 report?" How to answer honestly when you don't (yet)

  Most small SaaS companies don't have a SOC 2 report when the first enterprise questionnaire arrives. How to answer honestly and keep the deal moving.