What the SIG is
The Standardized Information Gathering questionnaire is published by Shared Assessments, a membership body for third-party risk management, and updated every year. It is built as a library: the customer's risk team chooses which domains and questions apply to a vendor and sends the result, usually as an Excel workbook. The domains cover risk management, policy, asset management, human resources, physical security, operations, access control, application security, incident management, business resilience, compliance, privacy, supplier management and cloud, among others, and every question is mapped to the major standards such as ISO 27001 and NIST.
Core or Lite
The SIG Core is the full set, sent to vendors who hold sensitive data or support an important service. The SIG Lite is a short subset with a question or two per domain, used for lower-risk vendors and for a first look. Because the customer scopes the file, two SIGs from two banks in the same year are rarely identical, even when both say Core.
How the answers are read
Most questions are answered yes, no or not applicable, with a comment. A "no" is not a failure; it is a finding the reviewer will ask about, so give the compensating control or the plan in the comment. A "yes" without a comment is weak on any question that asks about frequency, ownership or scope. "Quarterly, by the IT lead, recorded in the ticket system" is the kind of comment that closes a question. Not applicable needs a reason too: "we hold no cardholder data" rather than a bare N/A.
Reviewers compare the SIG with your evidence. Expect requests for your information security policy, your latest penetration test summary, your continuity plan, your insurance certificate and an assurance report if you have one.
Answering as a vendor
Answer the full SIG Core once, carefully, even if no customer has sent it yet. Every Lite and every scoped SIG is then a subset of answers you already have. Keep one approved answer per fact, not one completed SIG per customer: the facts change (a new backup schedule, a new sub-processor), and a library updates every future SIG at once, while old workbooks drift apart.
In Responsemate
Import the SIG workbook as it arrives, and each row is drafted from your knowledge base with its sources and a confidence score. The rows the library only half covers are marked for review, and the finished answers go back into the customer's own file. How questionnaires are imported and exported.
Questions people ask
What is the difference between the SIG Core and the SIG Lite?
The SIG Core is the full question set, meant for vendors who hold sensitive data or run a critical service. The SIG Lite is a short subset for lower-risk vendors or a first pass. A customer may start with the Lite and send the Core later if your answers raise the risk rating.
Can we send last year's SIG instead of filling in a new one?
Often, yes. Many customers accept a completed SIG from the current year, especially for the Lite. Ask before you start, and check that the version matches, because Shared Assessments publishes a new SIG every year.
Do we need a Shared Assessments licence to answer a SIG?
No. The licence is for the organisation that builds and sends the questionnaire. A vendor answers the file it receives.