Answer SIG questionnaires faster, with evidence behind every answer

The SIG (Standardized Information Gathering) questionnaire is a third-party risk assessment published by Shared Assessments. Buyers send it to vendors to understand how they manage security, privacy, resilience and related risks. The 2025 edition covers 21 risk domains, such as access control, privacy management, operational resilience and artificial intelligence, and it is refreshed every year to reflect new threats and regulations.

SIG Lite is a shorter, higher-level questionnaire for lower-risk vendors or initial screening, while SIG Core is a deeper assessment for critical vendors that store or process sensitive or regulated data. In the 2025 release SIG Lite has 128 questions and SIG Core has 627. Buyers can also build a custom SIG by selecting domains or questions from the full library of 1,936 questions.

No law requires the SIG. It becomes a requirement when a customer asks for it, usually as part of procurement, onboarding or contract renewal, and failing to complete it can delay or stop a deal. Many regulated organisations, especially in financial services, use the SIG to meet their own regulators' expectations for third-party risk management, which is why vendors receive it so often.

The SIG is published by Shared Assessments, a member organisation focused on third-party risk management. It is not free: organisations that want to send SIG questionnaires to their vendors license it through membership or a corporate licence. Vendors responding to a SIG usually do not need a licence themselves, because the buyer sends them the version they want completed.

The SIG is a questionnaire, not a certification, and it maps its questions to many standards and regulations, including ISO 27001, ISO 27002, the NIST Cybersecurity Framework and GDPR. If you already hold ISO 27001 certification or a SOC 2 report, much of the SIG can be answered from the same controls and evidence, and some buyers accept those reports as supporting evidence for SIG answers.

It depends on the scope and how organised your evidence is. A SIG Lite can be completed relatively quickly if policies and controls are documented, while a SIG Core touches every part of the business and often needs input from security, IT, HR, legal and privacy teams. Keeping a maintained library of answers and evidence is the biggest factor in reducing the time each new SIG takes.

The 21 SIG risk domains are Enterprise Risk Management, Nth Party Management, Information Assurance, Asset and Information Management, Human Resources Security, Physical and Environmental Security, IT Operations Management, Access Control, Application Security, Cybersecurity Incident Management, Operational Resilience, Compliance Management, Endpoint Security, Network Security, Environmental, Social and Governance, Privacy Management, Threat Management, Server Security, Cloud Hosting Services, Supply Chain Risk Management and Artificial Intelligence.

The SIG is mapped in OneClickComply's control library and available on request. That means SIG answers can draw on the controls, policies and evidence you already maintain for frameworks such as ISO 27001, SOC 2 or Cyber Essentials, and OneClickComply's security questionnaire automation can draft responses for review. OneClickComply does not issue SIG certifications, as the SIG is a questionnaire rather than a certification scheme.