Can the SIQ be signed electronically?

Yes. Under the ESIGN Act (15 U.S.C. ch. 96) and UETA (where adopted), electronic signatures are legally equivalent to handwritten signatures for most transactions, provided the parties consent to electronic records.

What evidence should accompany an SIQ?

Attach relevant artifacts such as SOC reports, ISO certificates, architecture diagrams, and policy excerpts. Evidence should be current and timestamped to avoid additional verification requests.

Who must sign the completed SIQ?

An authorized representative with authority to make representations for the vendor must sign. Legal or procurement teams often require a named executive or delegated signatory.

How long should signed SIQs be retained?

Retain SIQs according to contract lifecycle and regulatory needs: a minimum of 3 years for tax-related records (IRC §6501(a)) and 6 years for HIPAA-related records (45 CFR §164.530(j)), unless a longer period applies.

What if the vendor's security posture changes after submission?

Require prompt update and, where material, immediate disclosure. Contract language commonly requires notification and remediation obligations; document updates should be versioned and re-signed if needed.

Is notarization or witnessing normally required?

Not generally for SIQs. Specific documents attached to an SIQ (affidavits or jurisdictional attestations) may require notarization; state requirements vary, so check the recipient state's rules.

Electronic Signature
Templates
Miscellaneous
Security Information Questionnaire

Security Information Questionnaire

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

SECURITY INFORMATION QUESTIONNAIRE

Recitals

WHEREAS, Company Name: (the "Company") requires written security information from individuals and entities seeking access to Company facilities, systems, or data; and

WHEREAS, Respondent Name: (the "Respondent") is requesting such access and agrees to provide accurate information for risk assessment, authorization, and ongoing security compliance; and

WHEREAS, the parties intend that the information provided herein will be used to determine appropriate access levels and to document security obligations and acknowledgments.

Respondent Information

Full Legal Name Job Title / Role Employee or Contractor ID

Department

Supervisor / Sponsor

Contact Email Contact Phone Work Location / Address

Access Requested

Indicate all types of access requested:

Access Categories Physical site / facility access Network / VPN access Applications / Business systems Sensitive or regulated data Cloud platform / console access Cryptographic keys / token access

Describe the specific systems, applications, or assets for which access is requested

Systems and Credentials

List any existing accounts, identifiers, badge numbers, or keys that the Respondent possesses for Company systems:

Account / Asset 1 Account / Asset 2 Account / Asset 3

Background and Security History

Have you ever been subject to a security investigation, termination for cause related to security, or a breach involving sensitive data?

Yes No If yes, provide a factual description of the incident(s), dates, and remediation actions taken I consent to a background and security check as required by Company policy I have ongoing close personal or financial relationships with foreign nationals or governments If yes, list country(ies), nature of relationship, and dates

Security Clearance and Training

Current security clearance level (if any):

None Confidential Secret Top Secret Has Respondent completed required security training? Yes No

Scope of Work

Define the scope of access, tasks, and responsibilities associated with the requested access.

Payment Terms (if applicable)

If access is provided in connection with contracted services, set forth agreed fees and schedule.

Agreed Amount Payment Schedule / Milestones Late Payment Fee

Term and Termination

This Questionnaire and any authorization issued pursuant to it shall be effective as set forth below and may be revoked by Company at any time for cause.

Start Date:

End Date (if applicable):

Notice Period for Termination

Confidentiality and Data Handling

The Respondent acknowledges that access may provide information that is confidential, proprietary, or subject to legal or regulatory protections. The Respondent agrees to handle all such information in accordance with Company policies and applicable law, to restrict disclosure to authorized personnel only, and to implement reasonable safeguards against unauthorized access, use, copying, or transfer. Unauthorized retention, transmission, or use of Company confidential information is prohibited and may result in disciplinary action, revocation of access, civil liability, or criminal prosecution.

Data Handling Instructions (specific controls required)

Governing Law

This Security Information Questionnaire and any authorization or agreement arising from it shall be governed by and construed in accordance with the laws of the State of , without regard to conflict-of-law principles.

Entire Agreement

This Questionnaire, together with any written access authorization, policies referenced herein, and any executed agreements between the parties, constitutes the entire agreement with respect to the subject matter and supersedes all prior oral or written communications. No waiver or modification shall be effective unless in writing and signed by an authorized representative of the Company.

Acknowledgment and Certification

By signing below, the Respondent certifies that the information supplied in this Questionnaire is true, complete, and provided for the purpose of obtaining access. The Respondent understands that false statements, omissions, or failure to report changes in circumstances may result in denial or revocation of access and may subject the Respondent to disciplinary action or legal consequences where applicable.

I certify that the foregoing statements are true and complete to the best of my knowledge. I have read and agree to comply with Company security policies and data handling requirements.

Authorized Approvals (Company Use)

Approving Manager Name Approving Manager Title Approval Notes

Respondent:

By:

Date:

Company Representative:

By:

Date:

What a Security Information Questionnaire Is and When it’s Used

A Security Information Questionnaire (SIQ) is a standardized document that collects a vendor or partner’s technical, organizational, and procedural security details to support risk assessments, procurement reviews, and contractual due diligence. Typical content includes system architecture, access controls, encryption, incident history, and relevant certifications. Organizations use SIQs during vendor onboarding, renewals, or mergers to evaluate compliance with internal policies and regulatory obligations. Responses inform contractual controls, acceptance criteria, and any security remediation or attestation requirements before granting access to sensitive systems or data.

Why a Clear SIQ Matters for Compliance and Risk Management

A well-structured SIQ standardizes vendor security disclosures, reduces repetitive requests, and creates an auditable record for procurement and compliance teams. It helps demonstrate due diligence for HIPAA, FTC, and other regulatory expectations while supporting faster risk decisions.

Who Completes and Reviews the Security Information Questionnaire

Different teams participate in issuing, completing, and reviewing SIQs depending on organizational structure and the sensitivity of the data involved.

IT Security: Prepares technical responses, lists controls, and documents encryption, patching, and access management.
Procurement / Vendor Management: Issues the questionnaire, consolidates responses, and tracks remediation requirements.
Legal / Compliance: Reviews attestations, confirms contractual language, and verifies regulatory alignment.

Clear role separation speeds review cycles and ensures technical answers are validated by qualified personnel before submission.

Typical Signers and Their Responsibilities

CISO — Chief Information Security Officer

The CISO or delegated security lead reviews and certifies SIQ accuracy, provides context for high-risk items, and approves any attestation language. They coordinate remediation commitments and escalate material deficiencies to procurement and legal teams when needed.

Vendor Authorized Signer — VP/Director

An authorized executive or director signs to confirm the questionnaire responses are accurate and complete. Their signature binds the vendor to any representations and is required for formal acceptance and contracting.

Core Information the Security Information Questionnaire Typically Requires

Organization: Legal entity name

Primary Contact: Name, role, email

Systems Inventory: Cloud and on-prem systems

Security Controls: Auth, encryption, monitoring

Certifications: SOC 2, ISO 27001, HIPAA

Incident History: Recent breaches or incidents

Stepwise Process to Complete and Return the SIQ

Follow this sequence to collect accurate answers, validate evidence, and submit a complete SIQ for review.

01

Gather Documents: Collect SOC reports, policies, and architecture diagrams.
02

Assign Respondents: Delegate sections to system owners and security SMEs.
03

Complete Answers: Provide precise Yes/No responses and attach evidence.
04

Review & Sign: Security lead verifies technical accuracy, then authorized signer certifies.

Common Online Workflow Settings for Digital SIQ Submission

Configure your eSubmission workflow to ensure secure routing, required authentication, and persistent evidence of delivery and signing.

Field	Configuration
Authentication Method	Email link, SMS code, or KBA
Auto-Reminders	Send every 3 business days
Conditional Sections	Reveal based on prior answers
Accepted File Types	PDF, DOCX, images

Technical Requirements for eSubmission and Secure Handling

Ensure the chosen platform stores a tamper-evident certificate of completion, preserves attachments, and aligns with your retention and access control policies.

Integrations: Support for Salesforce, Google Workspace, NetSuite
File Formats: PDF and DOCX preserved on export
Authentication: Email, SMS, KBA, and SSO options

Where to Send or File the Completed SIQ

After completion, route the SIQ according to the requestor's instructions and retain an auditable copy for internal records.

Vendor Portal Upload: Upload to the requestor's secure portal per their instructions.
Email Submission: Send signed PDF to the designated procurement address.
Shared Repository: Store a copy in approved cloud storage (Box, Google Drive).
eSignature Archive: Keep the signed file and audit trail in your eSignature system.

Typical Response Timelines and Review Expectations

Response and review times vary by organization and the complexity of requested evidence; set realistic deadlines to avoid contract delays.

Initial Response Window:

10 business days for questionnaire completion

Evidence Submission:

Attach SOC reports and policies within 5 business days

Vendor Validation:

Security team review typically within 10–20 business days

Remediation Period:

30–90 days for agreed corrective actions

Incident Disclosure:

Contractual requirement often specifies notification timelines

Consequences of Incomplete or Incorrect SIQ Responses

Onboarding Delay: Contract paused

Contract Cancellation: Procurement rejection

Liability Risk: Misrepresentation exposure

Regulatory Penalty: Fines for noncompliance

Operational Risk: Access removal

Reputational Harm: Loss of trust

Common Mistakes That Slow SIQ Approval

Providing vague or high-level answers without attachments forces repeated follow-up and lengthens review cycles.
Submitting outdated certificates or expired SOC/ISO reports causes reviewers to request current evidence.
Using a generic signer without authority leads to re-signing and contractual delays.
Omitting contact details for remediation owners prevents timely validation of corrective actions.

Comparing Common eSignature Options for SIQ Delivery and Signature Collection

Platform choice affects authentication options, compliance features, and cost; the table below compares basic plan-level attributes across vendors with signNow listed first.

	signNow	DocuSign	Adobe Sign	PandaDoc	HelloSign
Starting Price	$8/user/mo	$15/user/mo	$14/user/mo	$19/user/mo	$15/user/mo
Free Trial	7-day free trial	Varies by vendor	Varies by vendor	Varies by vendor	Varies by vendor
Bulk Send	Yes	Yes	Yes	Yes	No
Audit Trail	Yes	Yes	Yes	Yes	Yes
HIPAA Compliant	Yes	Yes	Yes	No	No

Frequently Asked Questions About the Security Information Questionnaire

Answers to common questions about e-signing, evidence, signing authority, retention, and post-submission changes.

Need help? Contact support

Can the SIQ be signed electronically?
Yes. Under the ESIGN Act (15 U.S.C. ch. 96) and UETA (where adopted), electronic signatures are legally equivalent to handwritten signatures for most transactions, provided the parties consent to electronic records.
What evidence should accompany an SIQ?
Attach relevant artifacts such as SOC reports, ISO certificates, architecture diagrams, and policy excerpts. Evidence should be current and timestamped to avoid additional verification requests.
Who must sign the completed SIQ?
An authorized representative with authority to make representations for the vendor must sign. Legal or procurement teams often require a named executive or delegated signatory.
How long should signed SIQs be retained?
Retain SIQs according to contract lifecycle and regulatory needs: a minimum of 3 years for tax-related records (IRC §6501(a)) and 6 years for HIPAA-related records (45 CFR §164.530(j)), unless a longer period applies.
What if the vendor's security posture changes after submission?
Require prompt update and, where material, immediate disclosure. Contract language commonly requires notification and remediation obligations; document updates should be versioned and re-signed if needed.
Is notarization or witnessing normally required?
Not generally for SIQs. Specific documents attached to an SIQ (affidavits or jurisdictional attestations) may require notarization; state requirements vary, so check the recipient state's rules.

be ready to get more

Join over 28 million airSlate SignNow users

Sign Now