One of the big changes in security I have seen over the years is a significant increase in the use of security questionnaires. Much of this is understandable and is a result of an increase in the importance of security to information systems and an increase in regulatory regimes. One of the challenges in the increased use of security questionnaires involves the relevancy of the questions as it pertains to business risk, and more specifically whose risk is being assessed.