What is the SIG Questionnaire?

The SIG (Standardized Information Gathering) questionnaire is a third-party risk assessment published by Shared Assessments. Buyers use it to evaluate a vendor's security, privacy, and control posture before or during a vendor relationship. It is a licensed product, distributed by organizations that hold a Shared Assessments license, and it covers risk domains spanning information security, privacy, business resilience, and more.

Shared Assessments publishes two main versions. SIG Lite is a shorter question set for an initial or lower-risk vendor review. SIG Core is the comprehensive version, covering the full set of risk domains in depth, used for higher-risk vendors or deeper due diligence. Which one a buyer sends usually reflects how much risk they believe your relationship carries, not the size of your company.

A worked example

A startup selling to a regulated enterprise buyer first receives a SIG Lite as part of initial vendor screening. Once the deal moves toward a signed contract, the buyer's risk team follows up with a SIG Core, since the vendor will now handle production data. The startup reuses its existing control evidence, the same access control policy, the same encryption configuration, to answer both, rather than building two separate responses from scratch.

A common mistake

The most common mistake is answering a SIG questionnaire from memory or best guess instead of from the same control evidence used for a SOC 2 or ISO 27001 program. A buyer's risk team can cross-check SIG answers against a submitted audit report, and any mismatch, even an honest one, reads as a red flag and slows the review down rather than speeding it up.

How it maps to an audit

Like the CAIQ, the SIG is a self-reported questionnaire, not an audit or certification. But because it asks about the same underlying controls a SOC 2 or ISO 27001 audit tests, such as access management, encryption, and incident response, the fastest way to answer one accurately is to keep it tied to your actual audit evidence rather than treating it as a separate exercise.

SIG requests usually show up in vendor security reviews. For help getting a blocked deal moving again, see security questionnaire help. For the CSA's equivalent cloud-focused questionnaire, see what is the CAIQ.