Question 1

What is a SIG questionnaire?

Accepted Answer

The Standardized Information Gathering (SIG) questionnaire is a comprehensive vendor assessment tool developed by Shared Assessments. It provides a standardized approach for organizations to evaluate the security and risk posture of their third-party vendors. SIG is widely used across industries, particularly in financial services, healthcare, and technology.

Question 2

What is the difference between SIG Lite and SIG Core?

Accepted Answer

SIG Lite is a condensed assessment with approximately 200 questions, designed for lower-risk vendors or initial assessments. SIG Core is the comprehensive version with 800+ questions covering 18 risk domains in depth. Organizations choose based on vendor criticality and risk level-critical vendors typically require SIG Core.

Question 3

What domains does the SIG questionnaire cover?

Accepted Answer

SIG covers 18 risk domains: Enterprise Risk Management, Security Policy, Organizational Security, Asset and Info Management, Human Resources Security, Physical Security, IT Operations Management, Access Control, Application Security, Cybersecurity Incident Management, Operational Resilience, Compliance, End User Device Security, Network Security, Privacy, Threat Management, Server Security, and Cloud Hosting Services.

Question 4

How often is the SIG questionnaire updated?

Accepted Answer

Shared Assessments updates the SIG questionnaire annually to address evolving threats, regulatory changes, and industry best practices. The current version is SIG 2024. Organizations should ensure they are responding to the current version and update their response library accordingly.

Question 5

Why do customers require SIG questionnaires?

Accepted Answer

Customers use SIG questionnaires to assess third-party risk before and during vendor relationships. Regulatory requirements (like OCC guidance for banks, HIPAA for healthcare) mandate vendor due diligence. SIG provides a standardized, comprehensive assessment that satisfies regulatory requirements and helps identify potential risks.

Question 6

How long does it take to complete a SIG questionnaire?

Accepted Answer

Initial SIG completion typically takes 2-4 weeks for SIG Lite and 4-8 weeks for SIG Core, depending on organizational readiness. Organizations with existing security documentation and certifications complete faster. Subsequent updates are faster once you have established response libraries.

Question 7

How do certifications affect SIG responses?

Accepted Answer

Certifications like SOC 2, ISO 27001, and HIPAA can streamline SIG responses significantly. Many SIG questions can be answered by referencing your audit reports and certifications. Some organizations allow certifications to satisfy certain SIG sections, reducing the response burden.

Question 8

What evidence should accompany SIG responses?

Accepted Answer

Supporting evidence includes: security policies and procedures, SOC 2 or ISO 27001 reports, penetration test summaries, business continuity plans, incident response plans, architecture diagrams, and evidence of employee training. Provide evidence that demonstrates actual implementation, not just policies.

Question 9

How do I handle "Not Applicable" responses in SIG?

Accepted Answer

Use "N/A" only when a control truly does not apply to your environment (e.g., physical security questions for a fully remote company with no offices). Always provide justification for N/A responses. Reviewers may flag excessive N/A responses as a concern.

Question 10

What are common SIG questionnaire mistakes?

Accepted Answer

Common mistakes include: vague or generic responses, copying answers without customization, inconsistent responses across questions, missing evidence attachments, outdated information, over-using "N/A", not explaining compensating controls, and not aligning responses with actual practices.

Question 11

How do I maintain SIG responses over time?

Accepted Answer

Maintain a central response library that is updated when policies change, controls are implemented, or certifications are achieved. Conduct quarterly reviews of your standard responses. Track version history and ensure responses accurately reflect your current state, not aspirational goals.

Question 12

What is the relationship between SIG and other assessments?

Accepted Answer

SIG aligns with major frameworks including NIST CSF, ISO 27001, SOC 2, and HIPAA. Organizations with these certifications can map their controls to SIG questions. Many questionnaires share similar questions, so maintaining good SIG responses helps with other assessments.

Question 13

Can I use SIG for my own vendor assessments?

Accepted Answer

Yes, organizations can license SIG from Shared Assessments to assess their own vendors. This provides consistency between how you are assessed and how you assess others. Using a standardized questionnaire also makes responses easier for vendors familiar with SIG.

Question 14

How do I handle subservice organizations in SIG?

Accepted Answer

SIG includes questions about subservice providers (your vendors). You should document critical subservices, explain how you assess their security (SOC 2 reports, contracts, questionnaires), and describe your oversight processes. This is especially important for cloud infrastructure and key services.

Question 15

What is a SIG response library?

Accepted Answer

A SIG response library is a maintained database of pre-approved responses to SIG questions that can be reused across multiple customer assessments. Building a response library significantly reduces completion time for future questionnaires and ensures consistency in how you represent your security posture.

SIG Questionnaire Response Generator

What type of organization are you?

How It Works

Who Should Use the SIG Questionnaire Generator?

SIG Questionnaire FAQ

More Resources

Policy Templates

Core Security

Access & Identity

Data Protection

Network & Infrastructure

Operations

Incident & Continuity

Development

Governance