The VSA questionnaire explained: what it asks and how to complete it without a security team

If a prospective customer sent you a spreadsheet titled “VSA Questionnaire” and asked for your answers, this guide is for you. The VSA is a common security questionnaire in the software industry, and like other standard frameworks, you can work through it predictably without an in-house security department.

What the VSA questionnaire is

In one sentence: the VSA questionnaire is a free, standard set of security and privacy questions that buyers send to software and SaaS vendors before they sign, published by the Vendor Security Alliance in two versions, VSA Core and VSA Full, and updated regularly.

VSA stands for Vendor Security Alliance. Founded in 2016 by security leaders from companies including Uber, Atlassian, Docker, GoDaddy, Twitter and Square, the Alliance was created to standardize third-party cybersecurity evaluations.

Unlike proprietary questionnaires that vary wildly between buyers, the VSA provides an open, standardized question set designed specifically for evaluating technology and SaaS vendors. (Note: Google’s open-source tool, VSAQ, is a separate questionnaire viewer—not the Vendor Security Alliance spreadsheet).

VSA Core vs VSA Full

• VSA Core is the shorter assessment. It focuses on essential security controls, proactive and reactive security, software supply chain, and data privacy. Buyers typically send Core to lower-risk SaaS vendors or tools that do not host critical enterprise infrastructure.
• VSA Full is an in-depth evaluation covering advanced infrastructure controls, physical security, and formal audit governance. It is usually required for vendors handling sensitive customer records or connecting directly to production environments.

Always complete the file your buyer sent. If you received VSA Full for a low-risk integration, you can politely ask if VSA Core is sufficient, but be prepared to answer what was requested.

What VSA questions look like, section by section

The exact wording and numbering change between versions, so always work from the file your buyer sent. The topics, though, are predictable. These are the kinds of questions to expect, with the shape of a good answer (the examples describe a fictional company, so write what is true for yours):

• Service overview: what your product does, what customer data it handles, and where it is hosted. Example: “A web app for invoicing. We store customer names, emails and invoice data, hosted on AWS in the United States.”
• Policies and standards: whether you have a written information security policy, who owns it, how often it is reviewed, and whether staff get security training. Example: “Yes. Our CTO owns the policy and reviews it every year. Staff complete training when they join and yearly.”
• Data protection and access control: encryption in transit and at rest, multi-factor authentication, how access is granted and removed, and access reviews. Example: “Yes. TLS 1.2+ in transit, AES-256 at rest through our cloud provider. MFA is required for all staff accounts.”
• Proactive security: vulnerability scanning, penetration testing, patching and secure development. If you have never had a pen test, say so and say what you do instead (see how to answer the penetration test question).
• Reactive security: logging, monitoring, and your incident response plan, including how fast you notify customers. See how to answer incident response questions.
• Software supply chain: how you track third-party code and libraries, and which subprocessors touch customer data. A public subprocessor list makes this section quick.
• Privacy: personal data you process, GDPR and CCPA obligations, data retention and deletion, and breach notification.
• Compliance: certifications and audit reports. No SOC 2 yet? Answer No plainly and add context (see the SOC 2 question).

Most of these questions also appear, worded differently, in CAIQ, SIG Lite and custom questionnaires. Our list of 50 common security questionnaire questions with example answers covers the same ground in more detail.

How VSA compares to other frameworks

• CAIQ is published by the Cloud Security Alliance and maps directly to the Cloud Controls Matrix (CCM).
• SIG Lite comes from Shared Assessments and is most common in banking, finance and insurance.
• HECVAT is designed specifically for selling software to higher education institutions.

The VSA was built by technology companies for software services, with a strong focus on modern cloud architectures, supply chain security, and privacy.

How to complete it step by step

1. Check the scoping tabs first. Many questions depend on whether you host data in the cloud, develop custom code, or process regulated information. Identify which sections apply before drafting.
2. Gather your source documents. Have your security policy, incident response plan, access control procedures, data protection policies, and subprocessor list ready (see how to answer a security questionnaire).
3. Answer factual technical questions first. Encryption standards, multi-factor authentication, backup schedules, and logging can usually be completed quickly.
4. Be transparent about missing controls. If you do not have a control, say so plainly, explain what compensating measures you take instead, and provide a target date if it is on your roadmap. Vague answers only prompt more questions (see 10 answers that invite follow-up questions).
5. Do not alter the customer’s workbook structure. Keep formulas, sheet names, and dropdown values intact so the buyer’s procurement team can evaluate it without formatting issues.
6. Save your approved answers. Most VSA questions repeat in the next customer questionnaire. Storing approved answers in an answer library turns future questionnaires into a quick review.

Common pitfalls

• Answering for your cloud provider (such as AWS or Google Cloud) rather than your own application and policies.
• Overpromising on controls that are still being built.
• Leaving questions blank instead of providing a clear N/A with a one-sentence justification.

Answering a VSA questionnaire with Rendro

Upload the VSA spreadsheet (.xlsx or .csv) as you received it. Rendro maps the question and answer columns, drafts responses strictly from your own policies, cites the exact source for each answer, and flags what your documents do not cover. It writes the answers back into the original file, leaving formatting and formulas untouched. You can start with a 14-day free trial or Rendro’s free plan.