By questionnaire
The questionnaires companies actually send.
Most of them are one of three documents wearing a different name. Here is what each one is, who sends it, and how to answer the questions in it, drawn from the same 41 worked answers.
CAIQ v4.0
41 questions answeredThe Cloud Security Alliance's questionnaire, and the one most often sent verbatim. 261 questions across 17 domains, usually as a spreadsheet with a yes/no column and a notes column.
SIG Lite
41 questions answeredShared Assessments' short form, favoured by financial services and by anybody who has been asked for the full SIG once and did not enjoy it. Broader than CAIQ and shallower.
ISO 27001 Annex A
31 questions answeredNot a questionnaire at all, but the control list most bespoke questionnaires are quietly derived from. Worth reading if the sheet you were sent has no standard name on it.
GDPR
3 questions answeredWhat this one asks, and how each question is best answered.
VSA Core
3 questions answeredThe Vendor Security Alliance's core questionnaire. Shorter than the others and more opinionated about what a good answer looks like.
Or answer the whole thing at once.
FillTrust drafts every question in these from your own documents, and shows the passage behind each answer.