Security Questionnaires
The SIG Questionnaire: SIG Lite, SIG Core, and How to Answer It
SIG definition
The SIG (Standardized Information Gathering) questionnaire is a third-party risk assessment published by Shared Assessments. Companies send it to vendors and service providers to collect consistent answers about security, privacy, resilience, and governance controls, so they can judge vendor risk without writing a custom questionnaire for every supplier.
If a customer just sent you a SIG spreadsheet, this guide explains what you are looking at, how the versions differ, and a practical workflow for answering it quickly without contradicting your audit evidence.
Who Publishes the SIG: Shared Assessments
Shared Assessments is a member-driven organization focused on third-party risk management (TPRM). It was formed in the mid-2000s by large financial institutions, audit firms, and service providers who were tired of every bank sending every vendor a different security questionnaire. Their answer was a shared, standardized set of questions that any organization could use, and that vendors could answer once and reuse.
That shared set of questions is the SIG. Shared Assessments licenses it and updates it every year, so the question library keeps pace with new regulations, control frameworks, and threat patterns. The SIG has since spread well beyond banking: you will see it from insurers, healthcare organizations, technology companies, and any enterprise with a formal vendor risk program.
Because the SIG is licensed content, this guide describes its structure and the themes it covers rather than reproducing its questions. If you need the official documents, get them from Shared Assessments or from the customer that sent you the questionnaire.
SIG Lite vs SIG Core
The SIG is not one fixed document. It is a large question library that a buyer scopes down to fit the vendor and the service. In practice you will usually receive one of two standard scopes, or a custom cut of the full library.
SIG Lite
A short, high-level questionnaire covering the most important controls across the risk domains. Buyers use it for lower-risk vendors, for an initial screen before deciding whether a deeper review is needed, or for periodic reassessment.
Typical effort: hours to a few days, depending on how much of your answer library you can reuse.
SIG Core
The comprehensive version for vendors that store or process sensitive or regulated data, or that deliver a critical service. It goes control by control and expects detail and evidence, not just yes/no answers.
Typical effort: days to weeks the first time, involving security, IT, legal, HR, and facilities owners.
Recent releases also formalize scoping presets so buyers can match questionnaire depth to vendor risk without editing the spreadsheet by hand. Whatever the scope, check the version year on the cover tab first: question numbering and wording change between annual releases, so answers copied from last year's SIG may not line up.
How the SIG Is Structured
Current versions of the SIG group questions into 21 risk domains. The domains cover the familiar information security topics plus wider operational and governance risk:
The workbook usually opens with a business information tab (company details, the service in scope, locations, and key contacts), followed by the domain tabs. Many questions start with a yes/no/N/A answer and invite an additional comment, and those comments are where reviewers look for substance.
Each question is mapped to external standards and regulations such as ISO 27001, the NIST Cybersecurity Framework and NIST SP 800-53, PCI DSS, and privacy laws. That mapping is useful to you as a vendor: if you hold an ISO 27001 certificate or a SOC 2 report, the same controls your auditor tested answer a large share of the SIG. The 2026 release extended the mappings to AI governance (ISO 42001) and operational resilience.
Who Sends a SIG, and When
A SIG usually arrives from a customer's third-party risk, procurement, or security team at one of three moments:
- During a sale, often alongside an RFP or right before contract signature. Here the questionnaire is on the critical path to revenue.
- At onboarding, when a new vendor is added to the buyer's vendor inventory and assigned a risk tier.
- At reassessment, commonly annually for critical vendors, to confirm nothing material has changed.
Financial services buyers are the heaviest users because regulators expect them to oversee their vendors, but any enterprise with a formal vendor risk program may send one. If the buyer prefers the cloud-focused CSA questionnaire instead, see our CAIQ guide, and for custom questionnaires see vendor security questionnaires.
How to Answer a SIG Questionnaire Fast
Confirm scope and version before you answer anything
Ask which version year and which scope (Lite, Core, or custom) the buyer expects, which service and data are in scope, and the deadline. Mark domains that genuinely do not apply as N/A with a one-line reason, for example no physical data center if you run entirely on a public cloud provider. Scoping first avoids answering hundreds of questions that nobody will read.
Build an evidence library once
Collect the documents that answer most SIG questions: information security policy, access control and incident response policies, business continuity and disaster recovery plans, your SOC 2 report or ISO 27001 certificate and Statement of Applicability, penetration test summary, privacy policy and DPA, and your subprocessor list. Keep them current and in one place.
Reuse approved answers, do not rewrite them
Most SIG questions repeat across customers and years. Keep a library of approved answers keyed to topics rather than to question numbers, since numbering shifts between releases. Start every new SIG from that library and only write fresh answers for genuinely new questions.
Assign an owner to every domain
Route access control to IT, HR security to people operations, privacy to legal, resilience to operations. One coordinator owns the deadline and consistency; domain owners own accuracy. This is what keeps a SIG Core from stalling for weeks in someone's inbox.
Keep answers consistent with your audit evidence
Reviewers cross-check SIG answers against your SOC 2 report, ISO certificate, and policies. If the SIG says you review access quarterly and your SOC 2 says annually, expect a follow-up. Quote your policies rather than paraphrasing them loosely, and reference the supporting document in the comment field.
Answer the question that was asked, then stop
A good SIG comment states the control, how it operates, and where the evidence is, in two or three sentences. Long marketing answers slow the reviewer down and invite more questions.
For the end-to-end automation workflow, read how to automate security questionnaires.
Common SIG Pitfalls
Answering "Yes" without a comment
A bare yes on a control that matters (encryption, MFA, logging) almost always triggers a follow-up. Add one sentence on how the control works.
Copying last year's file
Question numbers and wording change with each annual release. Pasting answers row by row into a new version misaligns them, sometimes silently.
Over-promising
Answers in a SIG can end up referenced in the contract. Do not claim a control you are still planning; say what is in place today and what is on the roadmap.
Inconsistent answers across customers
If three account teams answer the same question three different ways, one of them is wrong. A single approved answer library prevents that.
Ignoring N/A justification
Marking whole domains N/A without explanation looks like avoidance. A short reason keeps the reviewer on your side.
How RFP.ai Helps with SIG Questionnaires
RFP.ai is security questionnaire software that drafts SIG answers from the documents you already trust:
- Upload the SIG spreadsheet; RFP.ai keeps the original structure and fills in the answers so you can export it back to Excel.
- Each draft answer is grounded in your own policies, audit reports, and previously approved answers, with a source citation you can click to verify.
- Confidence scores show which answers are solid and which need an expert, so reviewers start with the weak ones.
- Low-confidence answers route to a human reviewer before anything goes back to the customer.
- Approved answers flow back into your library, so the next SIG, CAIQ, or custom questionnaire starts further ahead.
Read how we handle your data on the security page, or compare plans.
SIG Questionnaire FAQ
SIG stands for Standardized Information Gathering. It is the third-party risk questionnaire published by Shared Assessments and used by many banks, insurers, healthcare organizations, and enterprises to assess the security and risk controls of their vendors.
SIG Core is the comprehensive version, intended for vendors that store or access sensitive or regulated data or deliver critical services. SIG Lite is a much shorter subset that covers the highest-priority controls across the same risk domains and is typically used for lower-risk vendors or as an initial screen before a deeper review.
Recent versions of the SIG organize questions into 21 risk domains, including enterprise risk management, access control, application security, privacy, cloud services, supply chain risk management, and artificial intelligence. Buyers can scope the questionnaire so a vendor only answers the domains that are relevant to the service.
Shared Assessments releases a new version of the SIG every year so it keeps pace with new regulations, frameworks, and threats. The 2026 release, for example, added mappings for AI governance and operational resilience. Always confirm which version year your customer sent, because question wording and numbering change between releases.
Sometimes, partially. Many buyers accept a SOC 2 Type II report or ISO 27001 certificate as supporting evidence and may reduce the scope of the SIG accordingly, but most still expect the questionnaire itself to be completed. Your SIG answers should be consistent with what your audit reports say, because reviewers will cross-check them.
It depends on the version and scope. A SIG Lite answered from a well-maintained answer library can be a matter of hours, while a first-time SIG Core with no prior answers can take weeks of coordination across security, IT, legal, and HR. Reusing approved answers and evidence is the biggest lever for speed.
AI can draft most answers if it is grounded in your own security policies, audit reports, and previously approved questionnaire answers. The drafts still need human review. RFP.ai attaches a source citation and a confidence score to each drafted answer so reviewers can verify it quickly and focus on the questions that need an expert.
Answer your next SIG from approved sources
Try RFP.ai free to draft SIG answers from your own security documentation, with a citation and confidence score on every answer and a reviewer in the loop. Or start with the free question extractor, no signup needed.
Related Resources
CAIQ Questionnaire Guide
The CSA cloud security questionnaire, CAIQ-Lite, and how to answer it
GuideVendor Security Questionnaires
What buyers ask vendors about security and how to answer consistently
AutomationHow to Automate Security Questionnaires
Step-by-step AI workflow for SIG, CAIQ, and custom questionnaires
Still not sure if RFP.ai is right for you?
Let ChatGPT, Claude, or Perplexity do the thinking for you. Click a button and see what your favorite AI says about RFP.ai.
Ask ChatGPTOpens ChatGPT in a new tab with a pre-filled question about RFP.ai. We do not see your conversation.
Ask ClaudeOpens Claude in a new tab with a pre-filled question about RFP.ai. We do not see your conversation.
Ask PerplexityOpens Perplexity in a new tab with a pre-filled question about RFP.ai. We do not see your conversation.