Using Standard Response Templates (SIG, CAiQ, CORL, ePSA, and HECVAT)

Overview

A standard response template is a questionnaire with common questions asked by a company when looking to enter into an agreement with a vendor or service provider, or for ongoing evaluations of existing vendors.

• These templates are available for purchase from different issuing associations with knowledge of best practices. Some are designed for specific industries or organizations and others are more generic.
• The templates focus on security controls within an organization, and use those controls to specify the degree of risk involved in working with that vendor.

Responsive does not issue standard response templates, or control the questions included on them, or how frequently new templates are issued. We work with the issuing institutions to make sure the latest versions are supported.

Our application is designed to streamline the process of responding to these templates by allowing you to import them without having to map content (such as sections, questions, or answers) as you normally would.

We support the following templates:

• Standardized Information Gathering (SIG) issued by Shared Assessments
  • Security Questionnaire - Core
  • Security Questionnaire - Full
  • Security Questionnaire - Lite
• Consensus Assessment Initiative Questionnaire (CAiQ) issued by the Cloud Security Alliance
• CORL issued by CORL Technologies
• ePSA issued by EPRI
• Higher Education Community Vendor Assessment Toolkit (HECVAT) issued by Educause

Best Practices

• Check to see if people other than your Response Managers are answering these types of questionnaires. If so, they could save time and effort by importing them into the application and using the Answer Library/Content Library to complete them.
• You can import a completed standard template in your Library to reuse the answers in future responses.

Select the applicable tab for your edition of Responsive.

• Responding to Standard Response Templates

  When you receive a questionnaire that is a standard response template, do the following to import it:

  1. Create a project in Responsive.
     
  2. Click Upload Document., then drag and drop the file in the main pane or click Upload from local drive to browse to it.
     
  3. Wait a minute or two for the file to be imported and configured; you will see a status message while it loads.
     
  4. When the import is finished, you will receive a success message with information about the file that was uploaded. Click Go to Sections to begin working on the project.
     
     
     • The CAIQ and CORL templates can be edited once the system automatically configures them.
     • The SIG, ePSA, and HECVAT templates are automatically configured and cannot be edited by the user; however, they can be edited by a Responsive Support member upon user request.
       
     • Some of the standard files have a tab that lists copyright or version information. If that tab is missing, the file may have been altered by the issuer. If the file was altered, the it will be treated like a normal Excel file rather than a standard response template.

• Essentials features are subscription-based and may not be available for all users. Contact your account manager, or accountmanagers@responsive.io, for more details.

  Responding to Standard Response Templates

  When you receive a questionnaire that is a standard response template, do the following to import it:

  1. Create a project in Responsive.
     
  2. Click Upload Document., then drag and drop the file in the main pane or click Upload from local drive to browse to it.
     
  3. Wait a minute or two for the file to be imported and configured; you will see a status message while it loads.
     
  4. When the import is finished, you will receive a success message with information about the file that was uploaded. Click Go to Sections to begin working on the project.
     
     
     • The CAIQ and CORL templates can be edited once the system automatically configures them.
     • The SIG, ePSA, and HECVAT templates are automatically configured and cannot be edited by the user; however, they can be edited by a Responsive Support member upon user request.
       
     • Some of the standard files have a tab that lists copyright or version information. If that tab is missing, the file may have been altered by the issuer. If the file was altered, the it will be treated like a normal Excel file rather than a standard response template.