What buyers conduct through security questionnaires is essentially a risk assessment, evaluating whether the vendor can be trusted to host their data and access permissions.