The data room security questionnaire: SIG, CAIQ and the questions that matter

Every larger buyer of software has a third-party risk process, and a data room provider will meet it sooner or later. For a bank, a listed company or a private equity firm, the room is a vendor that will hold some of the most sensitive files the organization ever shares. The security team wants to know how that vendor protects them before anyone signs an order form.

The trouble is timing. Deals rarely wait for a six-week vendor review. This guide explains which questionnaire to use, what evidence to ask for, which questions are specific to deal rooms and how to get through the process quickly without lowering the bar.

What is a data room security questionnaire?

It is a structured set of questions about a provider’s security controls, sent by a prospective customer as part of vendor due diligence. The provider answers in writing and supplies evidence: audit reports, certificates, policies and test results. The customer’s security or risk team scores the answers and decides whether to approve the vendor, approve it with conditions, or reject it.

For data rooms the questionnaire usually sits alongside a commercial evaluation. Our guide to questions to ask a data room provider covers the broader buying conversation. This piece is narrower: the formal security review.

Which questionnaire format should you use?

The Standardized Information Gathering questionnaire is updated regularly, so question counts vary by year and by the scoping you choose. Whatever format you pick, ask the provider whether it already has a completed version. Re-answering a standard questionnaire from scratch can take a provider weeks; sending an existing one takes a day.

What evidence should come with the answers?

A questionnaire answer such as “all data is encrypted at rest” is a claim. Evidence turns it into something you can rely on.

• SOC 2 Type II report. An independent auditor’s opinion on whether controls operated effectively over a period. Read the system description, the period covered, any exceptions and the complementary user entity controls you are expected to run.
• ISO/IEC 27001 certificate. Confirms a certified information security management system. Check the certificate’s scope and expiry; the ISO 27001 standard describes what certification covers.
• Penetration test summary. A recent external test of the application, with a statement of how high-severity findings were fixed.
• Business continuity and disaster recovery. Recovery time and recovery point objectives, and evidence of the last test.
• Subprocessor list. Every third party that handles room data, with location.
• Policies. Access control, encryption, incident response, secure development, vendor management.

In our directory, all sixteen providers list SOC 2 and eleven list ISO 27001. The methodology page explains how certifications feed our security scores. Our records note what is listed, not the scope; scope is exactly what your security team should check.

Which questions are specific to data rooms?

Standard questionnaires are written for any software vendor. A deal room has its own risks, so add a short supplement. These are the questions we would always include.

Administrator access. Can provider staff open documents in a customer’s room? Under what approval, and is it logged in a way the customer can see?

Permissions model. Can permissions be set by group, folder and document? Can a group be blocked from download, print and screenshot? Is the default for a new user “no access”?

Document controls. Is dynamic watermarking applied on view, print and download? Can access to a downloaded file be revoked later through document rights management?

Authentication. Is two-factor authentication available and can it be enforced for every external user? Is single sign-on supported for internal users? See two-factor authentication in data rooms.

Residency and subprocessors. Where are documents, backups and logs stored? Can the region be chosen per room? Our guide to data room subprocessors covers how to read the list.

AI features. Which AI features exist, are any on by default, which model providers process content, and is customer content used for training?

Audit trail. Which events are logged, for how long, can logs be exported, and are they tamper-evident?

End of deal. How is a room archived, in what format, and how and when is data deleted after the contract ends? Will the provider certify deletion?

How do deal-room controls compare to standard ones?

What are the red flags in a provider’s answers?

Most answers will be fine. These are the patterns that should slow an approval down.

• No independent report. Self-assessment only, with no SOC 2 or ISO 27001 evidence.
• A narrow scope. The audit covers infrastructure or a hosting partner but not the application your users touch. Ask exactly what is in scope.
• Unresolved high findings. A penetration test summary with open high-severity items and no fix dates.
• Vague staff access. “Support can access rooms when needed” without approval, logging or customer visibility.
• Unknown AI processing. AI features with no list of model providers and no written statement on training.
• Shared answers across products. A large vendor answering for its whole group when the deal room runs on separate infrastructure.

None of these is automatically disqualifying. Each needs a follow-up question and, where it matters, a contract clause.

How long does a vendor security review take?

It depends more on the provider’s preparation than on your process. With a complete evidence pack, a fast-track review for a single deal can finish in a few working days. With a full SIG Core answered from scratch, a negotiated DPA and open questions, four to eight weeks is common. Our guide to how companies procure a data room sets the security review in the wider approval timeline.

How to run a fast-track security review for a live deal

1. Request the evidence pack on day one

   Ask each shortlisted provider for its completed SIG or CAIQ, SOC 2 report, ISO 27001 certificate, pen test summary and subprocessor list.

2. Send a short deal supplement

   Add 10 to 15 questions on staff access, residency, AI use, audit logs and deletion that the standard format does not cover.

3. Review scope and exceptions

   Read the SOC 2 system description and exceptions, and check the ISO certificate's scope and expiry.

4. Hold one call on gaps

   Clear open questions with the provider's security lead in a single call instead of email rounds.

5. Approve with conditions

   Record any compensating controls, such as enforcing 2FA or disabling AI features, and put contractual commitments in the order form.

6. Diary the re-review

   Set a date for the next annual review and for the provider's next SOC 2 report.

Does a questionnaire replace hands-on testing?

No. A questionnaire tells you what a provider says it does. A trial tells you how the controls behave for a real user. Check that a restricted bidder account cannot see a hidden folder, that watermarks carry the user’s name, and that the audit trail shows a test download. Our free trial test script has the steps. Full-featured rooms such as Ellty, iDeals and Datasite all expose these controls to administrators, so a trial is a quick way to confirm the questionnaire answers.