The SIG (Standardized Information Gathering) questionnaire is a standardized third-party risk questionnaire from Shared Assessments. A customer sends it to a vendor to learn how the vendor handles cybersecurity, privacy, data governance, business resiliency and related risks. Shared Assessments describes it as a common question library, so vendors answer one consistent format instead of a different custom form from every client.
It comes in two main presets, SIG Lite and SIG Core, and the right one depends on how much risk the vendor relationship carries. This guide covers both sides of the table: the buyer who has to send one and the vendor who has to fill one out. It includes the situations we see in Texas law firms, oil and gas companies and other regulated mid-market businesses.
TL;DR
- The SIG is a standardized vendor risk questionnaire from Shared Assessments. It is a set of vendor assertions, not a certification or an approval.
- SIG Lite is a high-level screen for lower-risk vendors. SIG Core is deeper and meant for medium-to-high-risk vendors that handle sensitive data or critical services.
- Choose the depth by inherent risk, and answer for the scoped service, not for your whole company.
- A completed SIG feeds a vendor risk program. It does not replace issue tracking, evidence review, contract controls or reassessment.
- Assign each domain to an accountable owner and keep current evidence ready before the questionnaire arrives.
Table of Contents
- What the SIG questionnaire is
- SIG Lite vs. SIG Core
- How the SIG process works
- For buyers: scoping the SIG to the relationship
- For vendors: answering a SIG without losing weeks
- What happens after the questionnaire is returned
- Our perspective: treat the SIG as a decision tool
- Where CISOSafe fits
- Common mistakes to avoid
- FAQ
- Sources
What the SIG questionnaire is
Shared Assessments created the SIG after recognizing that companies were creating and answering unique questionnaires for every partner. The result is a library of questions that a buyer can scope up or down. The official site says the questions span 19 risk domains. Other public sources cite different counts, such as 18 or 21, because releases and scoping versions change. Treat any number as tied to a specific release.
The release matters because the SIG is updated regularly. Shared Assessments has published key updates for the 2026 SIG Workbook. If a customer sends you a SIG, use the exact workbook and release they ask for. Do not substitute last year's answers into a newer file without checking each question.
The SIG is also an Excel-based document in its traditional form. The SIG FAQ explains that the questionnaire is generated from a stored template, either a standard scoping template or a custom one. Shared Assessments now also offers SIG EV, a digital version of the same method.
What a SIG response is and is not
A completed SIG is a structured set of vendor statements. It is not a certification, and it does not approve anything on its own. The buyer still has to compare the answers with its risk appetite, ask for evidence on material controls, and decide what to do with gaps: ask for clarification, require remediation, accept a compensating control, or document a formal risk acceptance.
The official FAQ makes a related point. SIG EV supports creating, distributing, collecting and scoring assessments, but it does not by itself provide full onboarding, issue tracking, evidence repositories or continuous monitoring. The questionnaire is one component of a vendor risk program.
SIG Lite vs. SIG Core
The most common question is which version to send or expect. The Which SIG Should I Use guide frames the choice around inherent risk and the service being assessed.
| SIG Lite | SIG Core | |
|---|---|---|
| Depth | Lower, program-level view | Deeper, control-by-control |
| Typical vendor | Lower-risk vendors | Medium-to-high-risk vendors |
| Best use | Preliminary screening, RFI/RFP diligence, or when a high-level view is enough | Vendors handling sensitive or regulated information, or services critical to operations |
| Effort for the vendor | Lighter | Heavier, usually needs several owners |
| Customization | Preconfigured template | Preconfigured template, or a custom SIG |
The guide also allows a custom SIG when neither preset fits. Lite, Core and custom scoping are risk-based starting points, not universal requirements. The decision is not whether a vendor can answer every possible question. It is whether the depth of the assessment matches the risk the vendor creates.
A practical way to choose
Ask four questions about the vendor:
- Will the vendor store, process or transmit sensitive, privileged or regulated data?
- Would an outage or breach at the vendor interrupt a critical business process?
- Does the vendor have network, system or production access, including any operational technology connection?
- Does the vendor rely on subprocessors or cloud providers that you would also be exposed to?
If all four answers are no, SIG Lite is usually defensible. If any answer is yes, plan for SIG Core or a custom scope that concentrates on the relevant domains.
How the SIG process works
Shared Assessments' process documentation separates a scoping template, the questionnaire sent to the third party, and an internal subject-matter-expert SIG. In practice the workflow runs like this:
- Determine inherent risk and purpose. Is this onboarding, annual review, or an RFP screen?
- Scope the questionnaire. Select domains, mapping references, control families and depth.
- Generate and distribute it. Send the correct template and release.
- Coordinate responses. The vendor routes each section to the person who owns that area.
- Review answers and evidence. The buyer checks claims against policies, reports and test results.
- Document gaps and remediation. Each gap gets an owner, a decision and a due date.
- Use the result. It informs onboarding, contract terms, renewal and ongoing monitoring.
Separating these steps matters. It keeps one person from guessing across security, privacy, resilience and compliance domains, which is the most common source of inaccurate answers.
For buyers: scoping the SIG to the relationship
A blanket questionnaire is hard to defend. The scoping guide expects the selected SIG to align with your inherent-risk calculation and with the service or product being assessed. For regulated organizations in Texas and the Gulf Coast, that means building the scope around the real relationship.
Law firms. Look at which vendors touch client files, privileged communications or matter data: document management, e-discovery, cloud storage, court-filing and billing tools. Ask about data location, encryption, access by vendor staff, subprocessors and how quickly the vendor will notify you of an incident. Your client engagement letters and outside counsel guidelines may impose their own requirements, so scope to those.
Oil and gas and energy operators. Vendors with remote access to production systems, SCADA or other operational technology deserve more scrutiny than a marketing agency. Add questions on network segmentation, remote-access controls, safety-related change management, and recovery of operational systems.
Regulated mid-market companies. Map the vendor's role to your own obligations, whether that is HIPAA, PCI DSS, SOC 2 commitments or contractual security terms. Include incident-notification obligations that flow down to the vendor.
Two habits keep a program workable. First, tier vendors by risk before sending anything, so low-risk suppliers get Lite and a small number of critical vendors get Core. Second, decide in advance what a bad answer triggers. A questionnaire with no consequence attached is paperwork.
For vendors: answering a SIG without losing weeks
If a customer has sent you a SIG, you can respond quickly and defensibly with a few disciplines. One vendor-side guide lays out a similar approach: use the requested workbook, assign owners, answer for the scoped service and have evidence ready.
Use the workbook the customer sent
Do not reformat it or send your own summary. Customers often feed responses into scoring tools, and changed structure breaks that. If a question is unclear, ask the customer for clarification and note the assumption in the comments field.
Assign every domain to an accountable owner
An IT lead rarely knows the details of vendor management, privacy requests and business continuity testing at the same time. Give each domain to the person who runs that function, and have one coordinator review for consistency and tone.
Answer for the scoped service
Answer based on the service and data the customer actually uses, not the whole enterprise by default. If your corporate environment and your hosted product differ, say which one each answer describes. Overstating coverage is a bigger risk than admitting a gap, because the customer can ask for evidence.
Keep evidence current
Prepare these items before the questionnaire arrives:
- Information security, privacy and incident response policies, with review dates
- Independent assurance reports, such as a SOC 2 report, where you have one
- Data-flow diagrams for the scoped service
- Disaster recovery and backup test results
- A current list of subprocessors and fourth parties
- Penetration test summaries and remediation status
Before sending any of it, check scope, audit period, version, applicability and confidentiality. A report that covers a different system or an expired period causes more follow-up than it prevents.
If your evidence request touches secure development, for instance for card-data environments, it helps to know what reviewers expect. A write-up on PCI DSS requirement 6.2.3.1 and code review approvals shows the kind of review evidence an auditor can ask for.
What happens after the questionnaire is returned
The returned SIG starts the work rather than ending it. A sound review does the following:
- Compares answers with the evidence supplied, and flags anything claimed but not shown.
- Scores or rates the response against the criteria set during scoping.
- Records each gap in a risk register with an owner and a decision: remediate, compensate or accept.
- Writes the required controls into the contract, including breach notification timelines, audit rights and subprocessor approval.
- Schedules reassessment based on risk tier, and sooner after a material change or incident.
This is where many programs stall. The questionnaire is complete, but nobody owns remediation tracking or the reassessment calendar. Leadership still has to make decisions, retain evidence and monitor outside the questionnaire itself.
Our perspective: treat the SIG as a decision tool
We work with law firms, energy companies and other regulated organizations, and we see the SIG from both directions. Some clients receive SIGs from their largest customers. Others need to send them to the vendors that hold their most sensitive data.
Our view is simple. The questionnaire is only as useful as the scoping behind it and the review after it. Vendors that treat it as a one-off scramble answer inconsistently and lose time. Buyers that send the heaviest version to every supplier collect piles of answers they never read.
We recommend a risk-tiered approach with named owners. Scope by inherent risk, keep a standing evidence library, and connect every returned assessment to a risk roadmap that leadership can read. For a managing partner or an operations executive, the useful output is not 800 answers. It is a short list of vendors, gaps and decisions with dates attached.
— vCISO
Where CISOSafe fits
Many smaller regulated organizations do not have a full-time security leader to run this process. Our virtual CISO services cover security risk assessments, compliance program management, policy and controls development, and audit and certification readiness, which are the inputs a SIG response draws on. If you need to answer a customer's SIG, or build a vendor review process of your own, you can talk to us about a vCISO engagement.
Common mistakes to avoid
- Sending Core to everyone. It overloads vendors and reviewers, and buries the vendors that matter.
- Reusing old answers blindly. Releases change, and so does your environment.
- Answering for the company instead of the service. Scope drift creates inaccurate statements.
- Treating a response as approval. It is an assertion that needs evidence and a decision.
- No reassessment cadence. A vendor that was low risk at onboarding may not be after a new integration.
FAQ
What is a SIG questionnaire?
It is a standardized set of questions from Shared Assessments that organizations use to assess the cybersecurity, privacy, resilience and other risks of their vendors. The buyer scopes the questions to the vendor's risk level, and the vendor answers in a common format. The answers are assertions the buyer must evaluate, not a certification.
What is the difference between SIG Lite and SIG Core?
SIG Lite is a lower-depth, program-level option for lower-risk vendors, early screening and RFI or RFP diligence. SIG Core is deeper and intended for medium-to-high-risk vendors that handle sensitive or regulated information, or provide services critical to operations. Shared Assessments also allows a custom SIG when neither fits.
Is the SIG a certification?
No. A SIG response is a structured set of vendor statements. The buyer decides whether those statements, supported by evidence, fit its risk appetite. Independent assurance, such as a SOC 2 report, is separate and can be offered as supporting evidence.
How should a vendor prepare to complete a SIG?
Use the workbook and release the customer requests, assign each domain to a named owner, and answer for the scoped service. Gather current policies, assurance reports, data-flow diagrams, recovery test results and subprocessor information in advance. Check each document for scope, period and confidentiality before sharing.
Does the SIG replace a vendor risk management program?
No. According to the official FAQ, the tooling supports creating, sending, collecting and scoring assessments but not full onboarding, issue tracking, evidence repositories or continuous monitoring. You still need remediation tracking, contract controls and a reassessment schedule.
Sources
- What is the SIG? TPRM Standard, Shared Assessments
- About Us, Shared Assessments
- SIG FAQ, Shared Assessments
- Coming Soon: 2026 SIG Workbook, Shared Assessments
- Which SIG Should I Use? Shared Assessments
- How to Append, SIG process documentation, Shared Assessments
- SIG questionnaire guide for vendors, Arphie