The deliverable

The same file your customer sent. Filled in, and provable.

No new format, no portal, no PDF summary. You get back the exact workbook you uploaded with the answer cells completed and the evidence beside each one, ready to send.

What you upload

Vendor_Security_Assessment.xlsxas received

Question	Response	Comments
Is MFA required for workforce access to production?
Are user access reviews performed at least quarterly?
Do you have a documented data retention schedule?

What you download

Vendor_Security_Assessment_completed.xlsxcompleted

Question	Response	Comments
Is MFA required for workforce access to production?	Yes	[SOC 2, CC6.1, p.3, "Multi-factor authentication is required for all workforce access to production systems."]
Are user access reviews performed at least quarterly?	Yes	[SOC 2, CC6.2, p.3, "User access reviews for production systems are performed quarterly."]
Do you have a documented data retention schedule?		Not answered: no document provided states a retention schedule.

Citations

Anatomy of a citation

Hover over each part.

[Acme_SOC2_Type_II_2026.pdf, CC6.1, p.3, "Multi-factor authentication is required for all workforce access to production systems."]

Document

The file you uploaded that supports the answer.

Control

The criterion or control reference, such as a SOC 2 Trust Services Criterion.

Page

Where to find it, so anyone can open the report and check.

Quote

The exact words from your document, matched against the source before delivery.

Fidelity

What changes, and what never does

Only answer cells are written. Response, comments or evidence, and in CAIQ, the implementation description and ownership columns.
Dropdowns are respected. Where a column has a dropdown (Yes / No / N/A, or CAIQ's ownership options), the answer is one of those values.
Qualified answers are clear. If the evidence only partly supports an answer, the narrative says so and the dropdown is left for your decision.

Formatting stays. Sheets, styles, merged cells, column widths and formulas are untouched; formula cells are never overwritten.
Checked byte for byte. After writing, every other part of the workbook is compared against your original to confirm nothing else moved.
Honest blanks. Questions your evidence doesn't cover stay empty, with a note naming the document that would answer them.

Formats

What you can send

Questionnaires	Excel workbooks (.xlsx, .xlsm): SIG Lite, CSA CAIQ v4, and custom vendor assessments with a question column and an answer column.
Evidence	PDF (text-based; scanned pages are flagged), Word (.docx), Markdown and plain text. Audit reports, policies, procedures, architecture notes, fact sheets.
Size	Up to 25 evidence files, 50 MB each, 200 MB per request.
Not supported yet	Online questionnaire portals (export them to Excel first), legacy .xls files, and image-only scans with no text layer.

The same file your customer sent. Filled in, and provable.

Anatomy of a citation

What changes, and what never does

What you can send

See it on your own questionnaire.