VSAQ explained: Google's vendor security questionnaire tool, and how it differs from the VSA

VSAQ stands for Vendor Security Assessment Questionnaire. It is an open-source framework that Google released so that any company can send vendors a questionnaire as a web form and get the answers back in a standard layout. It is a tool and a set of question templates, not a single fixed list of questions.

If a buyer sent you a link to a VSAQ, or you searched for “VSAQ” after seeing the letters in an email, this guide explains what it is, how it differs from the similarly named VSA spreadsheet, and how to answer it without a security team.

What VSAQ is

Google announced VSAQ in March 2016 on its [Open Source Blog](https://opensource.googleblog.com/2016/03/scalable-vendor-security-reviews.html). The source code is on [GitHub](https://github.com/google/vsaq) under the Apache License 2.0. Google describes it as a way to collect vendor answers and display them in templated form, and the same templates can be used for self-assessment.

The framework ships with four base questionnaires: web application security, security and privacy programs, infrastructure security, and physical and data center security. A buyer can use them as they are, or extend them with their own questions.

How it works in practice: the buyer sends you a link, you answer in your browser, you export your answers as a file, and the buyer loads that file back into the same questionnaire to review it. The open-source version needs no dedicated back end, so a buyer can host it as a static site.

Google says VSAQ is not an official Google product, and receiving one does not mean the buyer works with Google. Any company can host it and change the questions, so two VSAQs from two buyers can look quite different.

VSAQ vs the VSA questionnaire

The names are one letter apart, and buyers and vendors confuse them. They are different things:

If you were sent a spreadsheet called “VSA”, read our VSA questionnaire guide. If you were sent a link to a web form, you probably have a VSAQ. If you are unsure, ask the buyer which one they mean before you start.

What the questions cover

Because buyers can edit the templates, treat the questionnaire you were given as the source of truth. The four base areas give you a good idea of what to prepare:

• Web application security: how you handle authentication, sessions and input validation, and how you find and fix vulnerabilities in your own code.
• Security and privacy programs: who owns security, written policies, employee training, incident response, vendor management and how you handle customer data.
• Infrastructure security: where you host, how systems are configured and patched, network controls, logging and access to production.
• Physical and data center security: usually answered by pointing to your cloud provider's controls, plus your own office and device practices.

VSAQ questions are often yes/no with a follow-up box that opens depending on your answer. Treat the follow-up as the real question: a bare “yes” invites a question back. For wording that works, see 10 answers that invite follow-up questions.

How to answer a VSAQ step by step

1. Read the whole form first. Conditional questions mean one early answer can add or remove a dozen later ones, so a quick first pass saves rework.
2. Gather your documents: security policy, incident response plan, access control procedure, subprocessor list, and any past questionnaires. If you do not have them yet, our first enterprise security review checklist lists what to write first.
3. Answer from evidence. Every yes should be something you can show: a policy, a setting, a ticket. If you cannot show it, say what you do instead.
4. Separate your controls from your cloud provider's. For physical security and data centers, say the provider handles it and name the provider, then describe your own part.
5. Be plain about gaps. “No, not yet, planned for Q1” is a better answer than silence, and reviewers see it every day. For the usual hard ones, see the penetration test question and the SOC 2 question.
6. Export your answers and keep a copy. The exported file is the record of what you told the buyer, so store it where your team can find it next time.

Mistakes to avoid

• Treating a VSAQ like a quick form. It is a formal record of what you told the buyer. Do not tick yes to be safe.
• Answering with your provider's certifications as if they were yours. Say whose control it is.
• Not saving your answers. A web form leaves you with nothing to reuse unless you export it and keep the file.
• Mixing it up with the VSA. If the buyer meant the VSA spreadsheet, you will have answered the wrong thing.

Reusing your answers

Most VSAQ topics also appear in CAIQ, SIG Lite, HECVAT and custom questionnaires. Keep approved answers in one place and reuse them: our guide to building a security answer library shows how.

Rendro works on the spreadsheet (.xlsx or CSV) a buyer sends, drafting answers only from your own documents and marking what it cannot support as “Needs review”. If a buyer sends a web form like a VSAQ, you can copy the questions into a spreadsheet and still reuse your approved answers from earlier questionnaires. You can start with a 14-day free trial.