---
title: "Questionnaire field map - Trooth"
description: "Every fact Trooth can read, by the key a questionnaire answer cites, mapped to CAIQ v4 controls and SIG risk domains, and the column layouts for CAIQ, SIG, Vanta, Drata and Whistic."
canonical_url: "https://trooth.co/docs/questionnaire-field-map"
markdown_url: "https://trooth.co/docs/questionnaire-field-map.md"
generated_from: "the rendered page, converted to Markdown when this was requested"
agent_index: "https://trooth.co/llms.txt"
---

# Questionnaire field map

A questionnaire answer Trooth drafts from a reading cites the fact by stable key, with source, date and record version. Buyers can link the live profile to any answer.

Below: every key, mapped to the Cloud Security Alliance Consensus Assessments Initiative Questionnaire (CAIQ) version 4 and the Standardized Information Gathering (SIG) questionnaire, and each format's columns. Table version 2026-10-01.

## Fact keys and where they map

CAIQ ids and titles are from Cloud Controls Matrix 4.0. SIG question numbers are licensed by Shared Assessments and not reproduced, so SIG shows risk domains, and CAIQ shows a domain where no control fits.

| Fact key | What it is | CAIQ v4 | SIG risk domain |
| --- | --- | --- | --- |
| `aws_root_mfa` | MFA on the AWS root account | IAM-14 Strong Authentication | Access Control |
| `aws_iam_users_without_mfa` | IAM users without MFA | IAM-14 Strong Authentication | Access Control |
| `github_org_2fa_required` | Two-factor required across the GitHub organization | IAM-14 Strong Authentication | Access Control |
| `gitlab_group_2fa_required` | Two-factor required across GitLab groups | IAM-14 Strong Authentication | Access Control |
| `slack_workspace_2fa` | Two-factor required in the Slack workspace | IAM-14 Strong Authentication | Access Control |
| `okta_mfa_factor_coverage` | MFA enrollment policies in Okta | IAM-14 Strong Authentication | Access Control |
| `okta_admin_strong_factor` | Strong authenticator for Okta administrators | IAM-14 Strong Authentication | Access Control |
| `okta_session_lifetime` | Okta session lifetime | IAM-14 Strong Authentication | Access Control |
| `okta_deactivation_telemetry` | Account deactivation activity in Okta | IAM-07 User Access Changes and Revocation; HRS-06 Employment Termination | Access Control; Human Resources Security |
| `salesforce_admin_count` | Salesforce administrators | IAM-10 Management of Privileged Access Roles | Access Control |
| `github_branch_protection` | Branch protection on GitHub repositories | CCC-03 Change Management Technology; CCC-04 Unauthorized Change Protection | Application Security; IT Operations Management |
| `github_pr_reviews` | Review required before merge on GitHub | CCC-03 Change Management Technology; CCC-04 Unauthorized Change Protection | Application Security; IT Operations Management |
| `github_secret_scanning` | Secret scanning on new GitHub repositories | AIS-05 Automated Application Security Testing | Application Security |
| `github_code_scanning` | Code analysis alerts on GitHub | TVM-05 External Library Vulnerabilities; TVM-07 Vulnerability Identification | Threat Management; Application Security |
| `github_dependabot` | Dependabot alerts on GitHub | TVM-05 External Library Vulnerabilities; TVM-07 Vulnerability Identification | Threat Management; Application Security |
| `aws_ebs_encryption_default` | EBS encryption by default | CEK-03 Data Encryption | Network Security; Server Security |
| `cloudflare_edge_tls` | TLS posture at the Cloudflare edge | CEK-03 Data Encryption | Network Security; Server Security |
| `aws_s3_public_access` | S3 public-access block | DSP (Data Security and Privacy Lifecycle Management) | Cloud Hosting Services |
| `aws_cloudtrail_multi_region` | Multi-region CloudTrail logging | LOG-08 Log Records; LOG-11 Transaction/Activity Logging; LOG-12 Access Control Logs | IT Operations Management |
| `aws_guardduty` | GuardDuty threat detection | LOG-03 Security Monitoring and Alerting | Threat Management |
| `salesforce_field_audit_trail` | Salesforce field audit trail | LOG-08 Log Records; LOG-11 Transaction/Activity Logging; LOG-12 Access Control Logs | IT Operations Management |
| `salesforce_login_history_retention` | Salesforce login-history retention | LOG-08 Log Records; LOG-11 Transaction/Activity Logging; LOG-12 Access Control Logs | IT Operations Management |
| `resend_email_auth` | Email domain authentication | IVS (Infrastructure and Virtualization Security) | Network Security |
| `aws_backup_plans` | AWS backup plans | BCR-08 Backup | Operational Resilience |
| `aws_restore_tested` | Restore testing | BCR-08 Backup | Operational Resilience |
| `betterstack_uptime_monitors` | Uptime monitors | BCR (Business Continuity Management and Operational Resilience) | Operational Resilience |
| `betterstack_monitoring_active` | Better Stack monitoring | LOG-03 Security Monitoring and Alerting; LOG-05 Audit Logs Monitoring and Response | IT Operations Management |
| `datadog_monitoring_active` | Datadog monitoring | LOG-03 Security Monitoring and Alerting; LOG-05 Audit Logs Monitoring and Response | IT Operations Management |
| `sentry_monitoring_active` | Sentry monitoring | LOG-03 Security Monitoring and Alerting; LOG-05 Audit Logs Monitoring and Response | IT Operations Management |
| `sentry_error_monitoring` | Projects reporting errors to Sentry | LOG-03 Security Monitoring and Alerting; LOG-05 Audit Logs Monitoring and Response | IT Operations Management |
| `pagerduty_incident_response` | PagerDuty incident response | SEF-03 Incident Response Plans; SEF-06 Event Triage Processes | Cybersecurity Incident Management |
| `pagerduty_oncall_rotation` | On-call rotation | SEF-03 Incident Response Plans; SEF-06 Event Triage Processes | Cybersecurity Incident Management |
| `vercel_production_deploys` | Recent production deployments | CCC-03 Change Management Technology | IT Operations Management |
| `slack_message_retention` | Slack message retention | DSP (Data Security and Privacy Lifecycle Management) | Asset and Information Management; Privacy |
| `slack_external_sharing_restricted` | External sharing restricted in Slack | DSP (Data Security and Privacy Lifecycle Management) | Asset and Information Management |

## Export layouts

Each questionnaire exports in every layout below; rows keep the fact key and record version.

### CSA CAIQ v4

Columns: "Question ID", "Question", "CSP CAIQ Answer", "SSRM Control Ownership", "CSP Implementation Description (Optional/Recommended)", "CCM Control ID", "CCM Control Title", "Trooth fact key", "Trooth record version". The CAIQ answer column takes Yes, No or NA, which a sentence of evidence cannot decide on its own, so it is left for your team; the answer text goes in the implementation description. CAIQ question ids are per question and are not inferred; the CCM control the fact maps to is filled instead. Source: [CSA CAIQ v4.0.2 template columns](https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4).

### SIG Lite and SIG Core

Columns: "SIG risk domain", "Question", "Response", "Additional information", "Trooth fact key", "Trooth record version". The SIG questionnaire and its question numbers are licensed by Shared Assessments and are not reproduced. This export names the SIG risk domain each answer falls under, so it can be placed into your licensed copy. Source: [SIG risk domain names, from public descriptions of SIG Core and SIG Lite](https://sharedassessments.org/sig/).

### Vanta spreadsheet questionnaire

Columns: "Question", "Answer and explanation", "Trooth fact key", "Trooth record version". Vanta maps each spreadsheet column to Question, Answer (Yes, No, N/A), Answer and explanation, Explanation, or Skip this column. Map the first two columns to Question and Answer and explanation, and the Trooth columns to Skip this column, or keep them as a record. Source: [Vanta help: Excel Questionnaire Column Mapping Options](https://help.vanta.com/en/articles/11345459-excel-questionnaire-column-mapping-options).

### Drata questionnaire import

Columns: "Question", "Response type". Drata imports questions from a CSV of up to 500 questions, and text after a comma is read as a new column, so commas in question text are replaced with semicolons. Drata's import takes questions and their response type, not answers; the answers and their citations stay in the Trooth record and in the other exports. Source: [Drata help: Create and Manage Vendor Questionnaires](https://help.drata.com/en/articles/13557330-create-and-manage-vendor-questionnaires).

### Whistic external questionnaire responses

Columns: "Question ID", "Section & Control Headings", "Question Text", "Answer", "Comments". Whistic requires the Question Text and Answer columns in the first row and accepts Comments, Section & Control Headings and Question ID, up to 25 columns. The citation goes in Comments and the mapped CAIQ and SIG headings in Section & Control Headings. Source: [Whistic help: How to Export/Import External (non-Whistic Template) Questionnaire Answers](https://whistichelp.zendesk.com/hc/en-us/articles/14948030437399-How-To-Upload-External-Questionnaire-Responses).

## What an answer carries

Each drafted answer from [the API](https://trooth.co/docs/trust-profile-api) carries `cite`: `factKey`, `factLabel`, `factCategory`, `provider`, `evidenceId`, `observedAt`, `recordVersion` and `recordDigest`. Version and digest match the `Trooth-Record-Version` and `Trooth-Record-Digest` headers, or are null.

A profile link carries the profile and record addresses, the version, and who linked it when.

## Structured data

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "Organization",
      "@id": "https://trooth.co/#org",
      "name": "Trooth",
      "legalName": "Trooth, LLC",
      "alternateName": [
        "Trooth, LLC",
        "Trooth Network",
        "trooth.co"
      ],
      "url": "https://trooth.co",
      "logo": {
        "@type": "ImageObject",
        "@id": "https://trooth.co/#logo",
        "url": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png",
        "contentUrl": "https://trooth.co/brand/trooth-mark_black-on-white_1024.png",
        "width": 1024,
        "height": 1024,
        "caption": "Trooth"
      },
      "image": {
        "@id": "https://trooth.co/#logo"
      },
      "description": "Trooth is an infrastructure and cybersecurity company providing Machine-Readable Trust. The Trooth Network keeps one current Machine-Readable Trust Profile per company, each fact sourced. Trooth signs what it witnessed; company declarations are unsigned.",
      "foundingDate": "2025-12-16",
      "address": {
        "@type": "PostalAddress",
        "streetAddress": "777 Brickell Ave, Suite 500, PMB 1174",
        "addressLocality": "Miami",
        "addressRegion": "FL",
        "postalCode": "33131",
        "addressCountry": "US"
      },
      "contactPoint": {
        "@type": "ContactPoint",
        "contactType": "customer support",
        "email": "hello@trooth.co",
        "url": "https://trooth.co/contact"
      },
      "sameAs": [
        "https://x.com/Troothllc",
        "https://github.com/troothllc",
        "https://www.crunchbase.com/organization/trooth",
        "https://www.wikidata.org/wiki/Q141292994",
        "https://www.youtube.com/@Troothllc",
        "https://www.trustpilot.com/review/trooth.co"
      ]
    },
    {
      "@type": "WebSite",
      "@id": "https://trooth.co/#website",
      "url": "https://trooth.co",
      "name": "Trooth",
      "alternateName": "Trooth Network",
      "inLanguage": "en",
      "publisher": {
        "@id": "https://trooth.co/#org"
      },
      "potentialAction": {
        "@type": "SearchAction",
        "target": {
          "@type": "EntryPoint",
          "urlTemplate": "https://trooth.co/network?q={search_term_string}"
        },
        "query-input": "required name=search_term_string"
      }
    },
    {
      "@type": "ItemList",
      "@id": "https://trooth.co/#sitelinks",
      "name": "Trooth sitelinks",
      "itemListElement": [
        {
          "@type": "SiteNavigationElement",
          "position": 1,
          "name": "Join Trooth for free",
          "url": "https://trooth.co/signup"
        },
        {
          "@type": "SiteNavigationElement",
          "position": 2,
          "name": "Company, Trooth",
          "url": "https://trooth.co/network/company/trooth"
        },
        {
          "@type": "SiteNavigationElement",
          "position": 3,
          "name": "Trooth Network",
          "url": "https://trooth.co/network"
        }
      ]
    }
  ]
}
```