Kevin Yun

Ownership belongs with whoever is accountable for the deal, not whoever knows the most about security. Here's the split, and where each model breaks.

Posted by Kevin Yun | 2026-08-15T06:04:29.976Z

The questionnaire rarely arrives alone. Here are the nine documents that travel with it, why buyers want each, and what to send when you don't have one.

Posted by Kevin Yun | 2026-08-14T13:15:57.200Z

The SIG is broad third-party risk and costs money to license. The CAIQ is deep on cloud and is free and publishable. Most SaaS vendors meet both.

Posted by Kevin Yun | 2026-08-14T13:14:21.341Z

The tier of SIG you receive tells you how a buyer categorised your risk. Here's how to identify which one landed and what it means for effort and stakes.

Posted by Kevin Yun | 2026-08-13T08:43:12.685Z

Most of a security questionnaire is documentation work, not security work. Here's how to split it so your engineers spend two hours instead of two weeks.

Posted by Kevin Yun | 2026-08-13T08:40:42.594Z

The template that helps a SaaS vendor is not a blank questionnaire. It's a structured answer bank organised by topic, so the next assessment is retrieval.

Posted by Kevin Yun | 2026-08-12T09:03:08.706Z

A first security questionnaire is a buying signal, not a rejection. Here's how to triage it, who should own it, and what to do in the first forty-eight hours.

Posted by Kevin Yun | 2026-08-12T08:53:22.909Z

The CAIQ is the Cloud Security Alliance's free security questionnaire: 261 yes-or-no questions mapped to the Cloud Controls Matrix, and free to publish.

Posted by Kevin Yun | 2026-08-11T08:00:57.685Z

A SIG is a standardized security questionnaire from Shared Assessments. A customer sent you one because you now count as a third party worth assessing.

Posted by Kevin Yun | 2026-08-11T07:54:29.926Z