Questionnaire field map

Last updated: Oct 1, 2026View as Markdown

A questionnaire answer Trooth drafts from a reading cites the fact by stable key, with source, date and record version. Buyers can link the live profile to any answer.

Below: every key, mapped to the Cloud Security Alliance Consensus Assessments Initiative Questionnaire (CAIQ) version 4 and the Standardized Information Gathering (SIG) questionnaire, and each format's columns. Table version 2026-10-01.

Fact keys and where they map

CAIQ ids and titles are from Cloud Controls Matrix 4.0. SIG question numbers are licensed by Shared Assessments and not reproduced, so SIG shows risk domains, and CAIQ shows a domain where no control fits.

Fact key	What it is	CAIQ v4	SIG risk domain
`aws_root_mfa`	MFA on the AWS root account	IAM-14 Strong Authentication	Access Control
`aws_iam_users_without_mfa`	IAM users without MFA	IAM-14 Strong Authentication	Access Control
`github_org_2fa_required`	Two-factor required across the GitHub organization	IAM-14 Strong Authentication	Access Control
`gitlab_group_2fa_required`	Two-factor required across GitLab groups	IAM-14 Strong Authentication	Access Control
`slack_workspace_2fa`	Two-factor required in the Slack workspace	IAM-14 Strong Authentication	Access Control
`okta_mfa_factor_coverage`	MFA enrollment policies in Okta	IAM-14 Strong Authentication	Access Control
`okta_admin_strong_factor`	Strong authenticator for Okta administrators	IAM-14 Strong Authentication	Access Control
`okta_session_lifetime`	Okta session lifetime	IAM-14 Strong Authentication	Access Control
`okta_deactivation_telemetry`	Account deactivation activity in Okta	IAM-07 User Access Changes and Revocation; HRS-06 Employment Termination	Access Control; Human Resources Security
`salesforce_admin_count`	Salesforce administrators	IAM-10 Management of Privileged Access Roles	Access Control
`github_branch_protection`	Branch protection on GitHub repositories	CCC-03 Change Management Technology; CCC-04 Unauthorized Change Protection	Application Security; IT Operations Management
`github_pr_reviews`	Review required before merge on GitHub	CCC-03 Change Management Technology; CCC-04 Unauthorized Change Protection	Application Security; IT Operations Management
`github_secret_scanning`	Secret scanning on new GitHub repositories	AIS-05 Automated Application Security Testing	Application Security
`github_code_scanning`	Code analysis alerts on GitHub	TVM-05 External Library Vulnerabilities; TVM-07 Vulnerability Identification	Threat Management; Application Security
`github_dependabot`	Dependabot alerts on GitHub	TVM-05 External Library Vulnerabilities; TVM-07 Vulnerability Identification	Threat Management; Application Security
`aws_ebs_encryption_default`	EBS encryption by default	CEK-03 Data Encryption	Network Security; Server Security
`cloudflare_edge_tls`	TLS posture at the Cloudflare edge	CEK-03 Data Encryption	Network Security; Server Security
`aws_s3_public_access`	S3 public-access block	DSP (Data Security and Privacy Lifecycle Management)	Cloud Hosting Services
`aws_cloudtrail_multi_region`	Multi-region CloudTrail logging	LOG-08 Log Records; LOG-11 Transaction/Activity Logging; LOG-12 Access Control Logs	IT Operations Management
`aws_guardduty`	GuardDuty threat detection	LOG-03 Security Monitoring and Alerting	Threat Management
`salesforce_field_audit_trail`	Salesforce field audit trail	LOG-08 Log Records; LOG-11 Transaction/Activity Logging; LOG-12 Access Control Logs	IT Operations Management
`salesforce_login_history_retention`	Salesforce login-history retention	LOG-08 Log Records; LOG-11 Transaction/Activity Logging; LOG-12 Access Control Logs	IT Operations Management
`resend_email_auth`	Email domain authentication	IVS (Infrastructure and Virtualization Security)	Network Security
`aws_backup_plans`	AWS backup plans	BCR-08 Backup	Operational Resilience
`aws_restore_tested`	Restore testing	BCR-08 Backup	Operational Resilience
`betterstack_uptime_monitors`	Uptime monitors	BCR (Business Continuity Management and Operational Resilience)	Operational Resilience
`betterstack_monitoring_active`	Better Stack monitoring	LOG-03 Security Monitoring and Alerting; LOG-05 Audit Logs Monitoring and Response	IT Operations Management
`datadog_monitoring_active`	Datadog monitoring	LOG-03 Security Monitoring and Alerting; LOG-05 Audit Logs Monitoring and Response	IT Operations Management
`sentry_monitoring_active`	Sentry monitoring	LOG-03 Security Monitoring and Alerting; LOG-05 Audit Logs Monitoring and Response	IT Operations Management
`sentry_error_monitoring`	Projects reporting errors to Sentry	LOG-03 Security Monitoring and Alerting; LOG-05 Audit Logs Monitoring and Response	IT Operations Management
`pagerduty_incident_response`	PagerDuty incident response	SEF-03 Incident Response Plans; SEF-06 Event Triage Processes	Cybersecurity Incident Management
`pagerduty_oncall_rotation`	On-call rotation	SEF-03 Incident Response Plans; SEF-06 Event Triage Processes	Cybersecurity Incident Management
`vercel_production_deploys`	Recent production deployments	CCC-03 Change Management Technology	IT Operations Management
`slack_message_retention`	Slack message retention	DSP (Data Security and Privacy Lifecycle Management)	Asset and Information Management; Privacy
`slack_external_sharing_restricted`	External sharing restricted in Slack	DSP (Data Security and Privacy Lifecycle Management)	Asset and Information Management

Export layouts

Each questionnaire exports in every layout below; rows keep the fact key and record version.

CSA CAIQ v4

Columns: "Question ID", "Question", "CSP CAIQ Answer", "SSRM Control Ownership", "CSP Implementation Description (Optional/Recommended)", "CCM Control ID", "CCM Control Title", "Trooth fact key", "Trooth record version". The CAIQ answer column takes Yes, No or NA, which a sentence of evidence cannot decide on its own, so it is left for your team; the answer text goes in the implementation description. CAIQ question ids are per question and are not inferred; the CCM control the fact maps to is filled instead. Source: CSA CAIQ v4.0.2 template columns.

SIG Lite and SIG Core

Columns: "SIG risk domain", "Question", "Response", "Additional information", "Trooth fact key", "Trooth record version". The SIG questionnaire and its question numbers are licensed by Shared Assessments and are not reproduced. This export names the SIG risk domain each answer falls under, so it can be placed into your licensed copy. Source: SIG risk domain names, from public descriptions of SIG Core and SIG Lite.

Vanta spreadsheet questionnaire

Columns: "Question", "Answer and explanation", "Trooth fact key", "Trooth record version". Vanta maps each spreadsheet column to Question, Answer (Yes, No, N/A), Answer and explanation, Explanation, or Skip this column. Map the first two columns to Question and Answer and explanation, and the Trooth columns to Skip this column, or keep them as a record. Source: Vanta help: Excel Questionnaire Column Mapping Options.

Drata questionnaire import

Columns: "Question", "Response type". Drata imports questions from a CSV of up to 500 questions, and text after a comma is read as a new column, so commas in question text are replaced with semicolons. Drata's import takes questions and their response type, not answers; the answers and their citations stay in the Trooth record and in the other exports. Source: Drata help: Create and Manage Vendor Questionnaires.

Whistic external questionnaire responses

Columns: "Question ID", "Section & Control Headings", "Question Text", "Answer", "Comments". Whistic requires the Question Text and Answer columns in the first row and accepts Comments, Section & Control Headings and Question ID, up to 25 columns. The citation goes in Comments and the mapped CAIQ and SIG headings in Section & Control Headings. Source: Whistic help: How to Export/Import External (non-Whistic Template) Questionnaire Answers.

What an answer carries

Each drafted answer from the API carries cite: factKey, factLabel, factCategory, provider, evidenceId, observedAt, recordVersion and recordDigest. Version and digest match the Trooth-Record-Version and Trooth-Record-Digest headers, or are null.

A profile link carries the profile and record addresses, the version, and who linked it when.