What is a Security Questionnaire (SIG)?

What is a Security Questionnaire (SIG)?

A security questionnaire is a standardized set of questions an organization sends to a vendor to gather evidence about its security, privacy and resilience controls; the Standardized Information Gathering (SIG) questionnaire is the industry-standard version.

The SIG is published by Shared Assessments, a member organization for third-party risk practitioners, and is revised annually to track changes in regulation and threat. It is organized by risk domain, covering areas such as access control, application security, cloud hosting, incident management, business resilience, privacy, third and fourth-party management and, in recent editions, artificial intelligence, and it is mapped to control frameworks such as ISO/IEC 27001, NIST CSF and PCI DSS so that one set of answers can be reused across many customer requests. It comes in two forms: SIG Core, the comprehensive questionnaire for higher-risk vendors, and SIG Lite, a shorter subset for lower-risk relationships or initial screening.

Why it matters

• It replaces bespoke questionnaires. Vendors answer one standard set once and share it; buyers stop writing and maintaining their own.
• It is tier-aware. Core for critical vendors and Lite for the rest is the simplest way to scale assessment depth with risk.
• It structures the evidence. Domain-by-domain answers map directly to residual risk scoring and to control gaps that become findings.

How a questionnaire fits the assessment

The questionnaire is one input to the vendor risk assessment, not the assessment itself. The tier decides which version to send; the vendor completes it, often from a pre-answered library; the reviewer checks answers against expectations for that tier, validates high-risk answers with evidence such as policies, SOC 2 reports, certifications or test results, and turns unacceptable answers into findings. Answers are self-attested, so validation of the questions that matter most is what gives the exercise its value.

Choosing between SIG Core and SIG Lite

Use SIG Core for vendors that hold sensitive data, connect to your systems or support critical services, where a full picture across all domains is needed. Use SIG Lite for moderate and low-risk vendors, for early screening before a contract is likely, or where a certification already covers most domains and the questionnaire only needs to fill gaps. Both versions can be tailored by removing domains that do not apply to the service.

Alternatives and complements

• Cloud Security Alliance CAIQ for cloud service providers, mapped to the CSA Cloud Controls Matrix.
• SOC 2 Type II reports and ISO/IEC 27001 certificates as independent evidence to validate answers.
• Custom questionnaires for sector-specific obligations that a standard template does not reach.
• Continuous monitoring services for external security posture between assessments.

Related terms

• Vendor due diligence
• Third-party risk management (TPRM)
• Supplier risk scoring
• Security compliance management
• Cyber risk assessment
• Third-party risk

In SmartSuite

SmartSuite Third-Party Risk Management issues the questionnaire through a vendor portal, stores answers and evidence by domain, scores responses against tier expectations, and carries any gap into the findings register with an owner and due date.

Frequently asked questions

What does SIG stand for?

Standardized Information Gathering. The SIG questionnaire is maintained by Shared Assessments, a membership body for third-party risk management, and is updated annually. It provides a common set of questions across security, privacy and resilience domains so that vendors can answer once and share, and buyers can compare vendors on the same basis.

What is the difference between SIG Core and SIG Lite?

SIG Core is the full questionnaire covering every risk domain in depth and is used for critical or high-risk vendors. SIG Lite is a shorter subset intended for lower-risk vendors or initial screening. Both draw from the same question library, so a vendor that has completed Core can produce Lite without new work.

Are questionnaire answers enough to approve a vendor?

No. Answers are self-reported. For the questions that matter most for the vendor's tier, ask for evidence: policies, a SOC 2 report, certifications, penetration test summaries or a walkthrough. Treat the questionnaire as the map of where to look, and base the residual risk rating on what the evidence shows.