Security and compliance questionnaires
Completed security and compliance questionnaires that customers sent to a company, such as SIG, CAIQ and custom vendor-risk forms, with the company’s answers, evidence references and follow-up questions. Labs use them to train agents that answer due-diligence questionnaires accurately and consistently.
What a record contains
One questionnaire: the requester’s sector, each question with the answer given, evidence references, reviewer notes and follow-ups.
| Field | What it holds |
|---|---|
questionnaire_id, framework | SIG, CAIQ or custom |
requester_sector | Industry of the customer who asked |
questions[] | ID, answer, evidence reference, notes |
follow_ups[] | Clarifying questions and replies |
{
"questionnaire_id": "SQ-212",
"framework": "custom",
"requester_sector": "health insurer",
"questions": [
{"id": "ENC-3", "question": "Is customer data encrypted at rest?",
"answer": "Yes, AES-256 via the cloud provider's managed keys.",
"evidence_ref": "policy_encryption_v4"}
],
"follow_ups": [{"q": "Who can access the keys?", "a": "Two named platform admins, reviewed quarterly."}]
}How AI labs use it
- Questionnaire-answering agents
- Real answers to real requests.
- Consistency checks
- Find conflicting answers across questionnaires.
- Retrieval over evidence
- Map questions to the right policy or control.
Typical preparation requirements
Agreed with the supplier before any work begins. Typical requirements include:
- Details that would expose weaknesses generalized or removed
- Requesting customers pseudonymized
- Third-party audit reports excluded, since their use is restricted
Every dataset has a documented owner and confirmed licensing rights. See data governance on sourcex.si.
What makes a strong package
- Many questionnaires across years
- An answer library with versions
- Follow-up threads
Who typically holds it
- B2B software companies
- Fintech companies
- Healthcare IT vendors
- Managed service providers
Know a company like this?
Introduce the company to SourceX. If its data deal closes, you can earn up to $100,000 in referral fees, paid after the buyer accepts the data and SourceX receives payment.
Refer a companyQuestions
Can standard framework questions be included?
Some frameworks’ question sets are licensed by their publishers, so packages focus on the company’s answers and custom questions, and reference framework questions by ID.
Need this data for a model?
Describe what you need: domain, volume, history, format and licensing terms. SourceX looks for companies that hold it and can license it.