If your team has ever groaned at a questionnaire named “SIG” rather than a generic “security review,” you’ve met the Standardized Information Gathering questionnaire. Shared Assessments publishes and maintains it. It’s widely used by financial services, healthcare, and other buyers with formal third-party-risk programs. It’s one of the two standardized questionnaire formats worth knowing by name; the other is the CAIQ. Vendors tend to remember the SIG most, because it’s often the longest.
The short answer: the SIG questionnaire comes in two sizes. SIG Lite is a few-hundred-question summary screen; SIG Core runs well over a thousand questions across every control domain. The buyer picks the version based on how they tier the risk of the relationship. To stop dreading them, build one reusable answer set organized by Shared Assessments’ domain structure, and reuse it on every future SIG.
SIG Core vs. SIG Lite
The SIG comes in two working sizes. Knowing which one you’re looking at changes how you should plan for it.
SIG Lite is the shorter version. It’s a few hundred questions covering the major control domains at a summary level. It’s typically used for lower-risk vendor relationships, or as a first-pass screen before a deeper review. If you’re a smaller company being evaluated for a limited-scope engagement, SIG Lite is what you’re more likely to see.
SIG Core is the full version. It often runs well over a thousand questions across every control domain Shared Assessments tracks: risk management, access control, application security, cloud hosting, physical security, incident management, business continuity, privacy, and more. This is the version that produces the “why is this taking two weeks” reaction from a first-time recipient. It genuinely is that large, and a large share of the questions require specific, defensible detail rather than a checkbox.
The buyer chooses which version to send based on their own risk tiering of the relationship. A bigger contract, more sensitive data access, or a more regulated industry on the buyer’s side tends to trigger SIG Core rather than SIG Lite. You generally can’t request the shorter version. It’s determined by how the buyer’s risk program classifies the engagement.
Why the SIG feels harder than a bespoke questionnaire
Counterintuitively, a fully custom questionnaire from a single buyer can sometimes be faster to answer than a SIG. The reason is the SIG’s breadth. It reaches into control domains a smaller vendor may not have formal documentation for at all: physical security controls for an office you don’t have a formal policy on, business continuity planning beyond “we use a cloud provider with redundancy,” or vendor management processes for your own sub-vendors. A bespoke questionnaire from one buyer tends to ask about what that buyer specifically cares about. The SIG asks about everything Shared Assessments’ full control taxonomy covers, whether or not it’s relevant to your actual risk profile.
The practical implication is cost. Your first SIG Core response is disproportionately expensive relative to any single questionnaire you’ve answered before, because you’re likely writing first-draft policy language for domains you’ve never had to formalize. That cost mostly doesn’t repeat. The second SIG Core you receive draws on the same underlying library. Still, budget real time for the first one specifically.
Building a reusable SIG answer set
The general answer-library approach from our security questionnaire automation guide applies directly, with two SIG-specific adjustments:
1. Organize your library by Shared Assessments’ domain structure, not by “questionnaire from Buyer X.” The SIG’s control domains are standardized and stable across versions. So a library built around that structure transfers to every future SIG you receive. It also gives you a natural checklist for domains you haven’t documented yet.
2. Treat the first SIG Core as a policy-writing project, not a questionnaire-answering one. You may not yet have a written business-continuity plan, a formal vendor-management process, or documented physical-security controls. Your first SIG Core is the forcing function that makes you write them, not just answer around them. That’s real work. But it’s work you’ll draw on for every future questionnaire, SIG or otherwise, so do it properly rather than improvising placeholder answers under deadline pressure.
3. Expect SIG Lite requests to reuse most of the same library. SIG Lite is a subset of the same underlying control taxonomy. A well-built SIG Core answer set makes SIG Lite requests genuinely fast, often closer to an hour of review than a multi-day project. You’re selecting and lightly editing from material you already have.
4. Watch for version drift. Shared Assessments updates the SIG periodically, and question wording or scope can shift between versions. A library entry that answered “SIG 2023” precisely may need a light edit to match a newer version, even if your underlying practice hasn’t changed. Don’t assume an exact-text match years apart.
SIG and your trust center
Unlike the CAIQ, there’s no equivalent of the CSA STAR Registry for publicly registering a completed SIG response. Shared Assessments doesn’t run an open public registry the way CSA does. That makes a general trust center more valuable for SIG-heavy buyers specifically. You can’t point them at a public standardized-response database the way you can with CAIQ. So a strong public trust page (subprocessor list, certifications, policy summaries) is what deflects some SIG requests before they’re formally sent, and speeds up the ones that still arrive.
If building and maintaining that answer library and trust page yourself sounds like the real work, that’s the job KnytX for Business is built to run for a small team once it’s live. It pairs an AI-assisted answer library with a public trust center. For how a standalone trust layer stacks up against the big compliance bundles, see KnytX Trust vs Vanta & Drata. KnytX Trust isn’t live yet — join the waitlist to get in at launch.
Frequently asked questions
What is the difference between SIG Core and SIG Lite? SIG Lite is a few-hundred-question summary screen for lower-risk vendors. SIG Core runs well over a thousand questions across every control domain. The buyer chooses which to send based on how they tier the risk of the relationship.
Can you request SIG Lite instead of SIG Core? Usually not. The buyer’s risk program decides which version applies, based on contract size, data sensitivity, and industry. You generally answer whichever version they send.
Is there a public registry for the SIG like the CAIQ has? No. Shared Assessments doesn’t run an open public registry the way CSA does for the CAIQ. A strong public trust page is the closest equivalent for deflecting SIG requests.
Related reading
- Security questionnaire automation: what it is and how to do it — the general system this post specializes for the SIG.
- CAIQ automation, explained — the other standardized format, and its public-registry shortcut.
- What trust center software actually does — the layer that reduces SIG volume specifically, since there’s no public SIG registry to lean on.