A trust profile for procurement

The questionnaires buyers send

Two questionnaires dominate third-party risk assessments, and most bespoke ones borrow from them.

SIG (Standardized Information Gathering), maintained by Shared Assessments and updated annually, is a licensed library of questions across risk domains (access control, application security, business resilience, privacy, AI and others). It is issued in Core and Lite forms; buyers scope it to the services bought. The 2026 release continues the annual update cycle.

CAIQ (Consensus Assessments Initiative Questionnaire), from the Cloud Security Alliance, is free and maps one-to-one to the Cloud Controls Matrix v4. A completed CAIQ can be published on the CSA STAR registry as a Level 1 self-assessment, which many buyers accept as a first pass.

Both ask for the same underlying evidence that SOC 2 and ISO 27001 audits test: policies, access reviews, encryption, logging, incident response, vendor management, business continuity. Buyers also send AI addenda (see the AI Assurance Dossier guide), privacy addenda and, in regulated sectors, outsourcing questionnaires. The volume is the problem, not the difficulty.

Answer once, reuse with evidence

The efficient pattern is to maintain one evidence library and map every questionnaire to it, rather than answering each questionnaire from memory.

1. Build the library: each policy, certificate, report, test result and process document, with owner, version, date and review cadence.
2. Write canonical answers to the common question set (SIG and CAIQ cover most of it), each answer linked to the library items that prove it.
3. For a new questionnaire, map its questions to the canonical set, adjust wording where the buyer's question differs, and attach the same evidence.
4. Record every answer sent to every buyer, with date and version, so that a later question about what was said can be answered.

OpenDossier's Trust Workspace is built around this pattern. A company that claims its profile stores the library, writes canonical answers, and shares them with buyers from one place. Buyers see the answer, the evidence and the date, and they see the same verified registry facts that appear in the public dossier, which removes the entity, ownership and litigation questions from the questionnaire altogether.

Data rooms and access control

A data room is the private side of the trust profile. It holds the documents that should not be public but must be shown: SOC 2 reports, penetration-test reports, detailed architecture, insurance certificates, audited financial statements, the full sub-processor schedule, incident post-mortems.

Good practice for a data room used in procurement:

• Access by named individual at the buyer, under an NDA or the confidentiality terms of the buyer's own process, with expiry.
• An access log the company can review, so it knows who has seen what.
• Watermarking or view-only for the most sensitive items, with download allowed for documents the buyer needs to file.
• Versioning, so a buyer who downloaded a 2025 report can be told when the 2026 one arrives.
• A manifest that lists what is in the room, with dates, so a buyer can tell what is missing without opening each file.

In OpenDossier the data room sits behind the claimed profile, and each document in it can be referenced from a public claim without exposing the document: the public dossier says SOC 2 Type II report, period ending 30 June 2026, available under NDA, and the buyer requests access from the same page.

What to publish and what to keep private

The dividing line is whether disclosure helps an attacker or a competitor more than it helps a buyer. Buyers rarely need the document in public; they need to know it exists, is current and can be obtained. Publishing the fact and gating the document satisfies both procurement and security.

How a claimed profile reduces repeated work

A claimed OpenDossier profile combines three things buyers otherwise collect separately: the verified public record (entity, ownership where public, litigation, sanctions screening, IP, certifications checked at source), the company's own canonical answers with evidence, and the data room. The buyer's analyst starts from a file that already carries dates and sources, and the questionnaire shrinks to what is specific to the engagement.

Measured in practice, the saving is in the questions that no longer need asking: legal name and registration (verified from the registry), litigation history (searched and dated), sanctions (screened and dated), certifications (checked with the issuer), sub-processors (published with a change log). Those are the questions that generate the most back-and-forth because the buyer cannot otherwise verify the answer.

The profile also works in the other direction. A buyer who has assessed a vendor once can subscribe to monitoring on the same file and be told when a director changes, a certificate lapses or a case is filed, instead of re-running the full assessment at renewal. The next guide covers that.

Keeping answers honest

Questionnaire answers are representations, and in many contracts they become warranties. Three habits keep them accurate.

• Answer the question asked. If the honest answer is partially, say so and describe the gap and the plan with a date. Buyers accept gaps; they do not accept discovering them later.
• Tie every answer to evidence with a date. An answer that says encryption at rest is enabled should link to the configuration evidence or the audit test that confirms it, with the date checked.
• Review answers on a schedule and on change. The owner of each canonical answer re-confirms it at the review date and whenever the underlying control changes; the Trust Workspace shows the last-confirmed date beside every answer.

OpenDossier reviews the structure of a profile (that claims have evidence, dates and owners) and shows the review status; it does not vouch for the truth of a company's answers. Buyers can see which claims are verified against external sources and which are company-stated, and that distinction is what makes a trust profile trustworthy.