Most procurement teams send the same 200-question SIG questionnaire to every vendor — including the easy ones, including questions the vendor's contract already answers, including questions that aren't actually relevant to the vendor's category. The result: a 6-week back-and-forth that frustrates both sides and surfaces nothing useful. POCsheet's vendor questionnaire generator picks the 10–18 questions that actually matter for THIS vendor, based on what their contract already says.
The right number of questions is 10, not 200
The Shared Assessments SIG Lite has 100+ questions. The Cloud Security Alliance CAIQ has 261. SOC 2 Type II reports answer hundreds more. Sending all of them to every vendor is the worst of all worlds:
- The vendor copies and pastes generic answers, half of them irrelevant to their product.
- Your security team reads 200 vendor answers, none of them new information.
- The 8 questions that actually mattered get lost in the noise.
A focused questionnaire of 10–18 questions — chosen specifically because the vendor's existing contract doesn't address them — gets thoughtful answers from the vendor's security team and surfaces the real gaps.
How POCsheet generates it
Inside any completed comparison, open the "Questionnaire" tab. Pick a vendor + a framework (SIG Lite, CAIQ, SOC 2, or Custom — gaps-only). POCsheet's AI:
- Reads the vendor's contract text (the chat-context snapshot taken during analysis).
- Maps the framework's category taxonomy (e.g. SIG Lite's "Access Control", "Data Encryption", "Incident Response", "Sub-processors", "Business Continuity").
- For each category, generates only the questions the contract does NOT already answer — based on what's textually present in the document.
- Adds a one-sentence "rationale" per question: why this question matters given what the contract does and doesn't say.
The output is a clean list — grouped by category, "Copy all" to clipboard for paste into your security review email, ready to send to the vendor.
What this looks like in practice
Example output for a Cloud SaaS vendor whose MSA covers SOC 2 + ISO 27001 + DPA + breach notification SLA, but doesn't mention sub-processor disclosure or BCP testing:
- Sub-processors: "Please share the complete list of sub-processors with customer access, with their countries of operation and SOC 2 coverage status."
- Business Continuity: "Please describe your annual BCP testing cycle, with the most recent test date and outcomes of any identified gaps."
- Sub-processors: "Do you provide a mechanism for customers to be notified at least 30 days before adding a new sub-processor with access to customer data?"
- (…etc, 8–10 more questions, none of them already answered by the existing contract.)
Your security reviewer gets focused answers to the gaps. The vendor isn't drowning in 200 boilerplate questions. The negotiation moves forward.
Multi-framework support
POCsheet supports four framework choices:
- SIG Lite: shorter version of the full SIG, suitable for most B2B SaaS / professional services evaluations.
- CAIQ: Cloud Security Alliance's Consensus Assessments Initiative Questionnaire — the standard for cloud / IaaS vendors.
- SOC 2 Trust Services Criteria: framework-aligned for vendors making SOC 2 attestations.
- Custom — gaps only: skips the framework taxonomy and just asks about the specific gaps in the document. Best for vendors who've already shared a SOC 2 report and you just need to fill the remaining holes.
The bigger pattern
Procurement is full of "everyone sends the same form" rituals that no longer serve anyone. The SIG, the CAIQ, the security questionnaire, the DPA template, the InfoSec review checklist — all valuable as starting points, all wasteful when sent verbatim every time. AI tooling lets every evaluation be tailored to the actual vendor without sacrificing the rigour of the framework. POCsheet's questionnaire generator is one piece of that broader pattern.