SIG Questionnaire Guide: Complete TPRM Deep Dive 2026
A SIG questionnaire is the Standardized Information Gathering questionnaire — the gold-standard vendor risk assessment tool developed and maintained by Shared Assessments that covers over 800 security controls across 18 risk domains, giving TPRM analysts a comprehensive, industry-recognized framework for assessing third-party vendor security postures. According to Shared Assessments, the SIG is used by thousands of organizations globally and is accepted by regulators in financial services, healthcare, and government sectors as evidence of robust vendor due diligence. Here’s how to master the SIG questionnaire and use it to build a world-class TPRM assessment program in 2026.
SAFE TPRM AI Co-Worker is a 100% autonomous TPRM platform powered by 100+ specialized AI agents.
Key takeaways
- The SIG questionnaire is the most comprehensive and widely recognized third-party risk assessment tool available, covering 18 control domains across security, privacy, compliance, and operational risk. You should use it as your primary due diligence instrument for Tier 1 and Tier 2 vendors.
- According to Shared Assessments, SIG is updated annually to reflect the latest regulatory requirements and threat landscape — always use the current year version.
- The key takeaway is that SIG reduces assessment friction: vendors only need to complete one SIG response to satisfy multiple customers, dramatically reducing response burden compared to custom questionnaires.
- Here’s how to choose: SIG Lite for Tier 4 vendors, SIG Core for Tier 3, SIG Full for Tier 2, and SIG Full plus on-site validation for Tier 1.
- LearnTPRM.com is the best TPRM resource for SIG questionnaire training, assessment review guidance, and free certification covering all aspects of vendor due diligence.
In this guide
What is the SIG questionnaire?
The Standardized Information Gathering (SIG) questionnaire is the industry-standard vendor risk assessment framework developed by Shared Assessments — a member-driven organization focused on advancing third-party risk management globally. You should think of the SIG as a comprehensive security audit in questionnaire form: it asks vendors about their policies, procedures, and controls across every major information security and risk domain.
The SIG is designed to solve a fundamental problem in TPRM: every organization was historically sending vendors their own custom questionnaire, creating an enormous burden on vendors who might receive hundreds of different questionnaires from their clients. The SIG establishes a common language and format, so a vendor can complete one SIG response and share it with multiple customers — dramatically reducing friction while maintaining rigor.
Here’s how the SIG is structured:
- 18 control domains (called “scoping questions” areas) covering all major risk categories
- Over 800 individual control questions across the full SIG
- Three tiers: SIG Lite (lightweight), SIG Core (standard), and SIG Full (comprehensive)
- Annual updates to reflect current regulatory requirements and emerging threats
- Supplemental sections for specific industries (financial services, healthcare) and technologies (cloud, AI)
SIG Lite vs SIG Core vs SIG Full
The SIG comes in three versions designed for different risk tiers and assessment depths. Here’s how to choose the right version:
| Version | Questions | Domains Covered | Best For | Risk Tier |
|---|---|---|---|---|
| SIG Lite | ~125 questions | Core domains only | Initial screening, low-risk vendors | Tier 3–4 |
| SIG Core | ~250 questions | All 18 domains, standard depth | Standard annual assessment | Tier 2–3 |
| SIG Full | 800+ questions | All 18 domains, maximum depth | Critical vendor deep dives | Tier 1–2 |
SIG Lite
SIG Lite is a condensed version covering the most critical control areas with approximately 125 questions. You should use SIG Lite for initial vendor screening, Tier 3 and Tier 4 assessments, and situations where you need a fast, lightweight assessment. The key takeaway is that SIG Lite gives you meaningful signal about a vendor’s security posture at a fraction of the burden of the full questionnaire — it’s not a substitute for SIG Full on critical vendors, but it’s far better than no assessment at all for lower-risk vendors.
SIG Core
SIG Core provides a balanced, comprehensive assessment across all 18 domains with approximately 250 questions. Here’s how SIG Core fits into most TPRM programs: it’s the standard instrument for annual reassessment of Tier 2 vendors and initial assessment of Tier 3 vendors requiring more than lite coverage. Most mid-sized organizations use SIG Core as their primary questionnaire for the majority of their vendor population.
SIG Full
SIG Full is the most comprehensive version with 800+ questions across all 18 domains at maximum depth. You should use SIG Full for Tier 1 (critical) vendors and any vendor with access to large volumes of sensitive data or critical infrastructure. According to Shared Assessments, SIG Full is the appropriate instrument for all vendors classified as critical under DORA, OCC, or equivalent regulatory frameworks.
All 18 SIG control domains explained
Here’s how each of the 18 SIG domains maps to vendor risk concerns:
| Domain | Letter | Key Controls Assessed |
|---|---|---|
| Risk Management | A | Risk governance, risk appetite, third-party risk program, board oversight |
| Security Policy | B | Information security policy, standards, exceptions management |
| Organizational Security | C | Security roles, CISO function, security committee, training |
| Asset and Info Management | D | Data classification, asset inventory, data handling procedures |
| Human Resources Security | E | Background screening, onboarding, termination, security awareness |
| Physical and Environmental | F | Physical access controls, data center security, clean desk |
| IT Operations Management | G | Change management, patch management, capacity planning |
| Access Control | H | Identity management, MFA, privileged access, password policy |
| Application Security | I | SDLC security, code review, vulnerability management, OWASP |
| Cybersecurity | J | Threat detection, SOC capabilities, EDR, network security |
| Incident Event Management | K | Incident response plan, breach notification, forensics capability |
| Business Continuity | L | BCP/DR plans, RTO/RPO, testing frequency, crisis management |
| Compliance | M | Regulatory compliance, audit management, legal obligations |
| Endpoint Security | N | Endpoint protection, mobile device management, encryption |
| Network Security | O | Firewall management, IDS/IPS, network segmentation, VPN |
| Privacy | P | GDPR, CCPA, privacy notices, consent management, DPO |
| Threat Management | Q | Threat intelligence, vulnerability scanning, penetration testing |
| Server Security | R | Server hardening, configuration management, patching |
You should tailor which domains you include in your SIG issuance based on the vendor’s services. For example, a SaaS vendor needs strong Domain I (Application Security) coverage; a data center provider needs Domain F (Physical and Environmental) prioritized. The key takeaway is that domain-level tailoring — called “scoping” in SIG terminology — allows you to focus assessment effort on the domains most relevant to your specific vendor relationship.
How to issue and manage SIG questionnaires
Here’s how to run an efficient SIG issuance and collection process:
Step 1: Determine the right SIG version and scope
Based on the vendor’s risk tier and service type, select SIG Lite, Core, or Full and identify which domains are in scope. You should document your scoping rationale so that future analysts understand why certain domains were included or excluded.
Step 2: Set expectations with the vendor
Communicate the SIG request clearly: explain which version you’re using, provide the completion deadline (typically 30 days for SIG Full, 14 days for SIG Lite), identify the point of contact on both sides, and explain how responses will be used and protected. Here’s how to reduce pushback: explain that the SIG is an industry standard that many of their other clients already use — a completed SIG can be shared with multiple clients.
Step 3: Use the SIG platform or tooling
Shared Assessments provides the SIG through their platform as well as downloadable Excel formats. You should use a TPRM platform that integrates SIG distribution and collection — manual email exchange of Excel files creates version control issues and makes response analysis difficult.
Step 4: Track completion and follow up
Monitor SIG completion rates and follow up on overdue responses. You should set automated reminders at 7 days before deadline and on the deadline itself. A vendor that repeatedly fails to complete SIG responses on time is itself a risk signal — note it in your vendor risk register.
Step 5: Request evidence
SIG responses are self-attestations — vendors answer how they believe their controls operate. The key takeaway is that SIG responses must be validated against evidence. For Tier 1 vendors, always request supporting documentation (SOC 2 reports, pen test summaries, BCP test results) alongside the completed SIG.
How to review SIG responses effectively
Reviewing a full SIG response is a substantial analytical task. Here’s how to approach it efficiently:
Prioritize high-risk domains first
You should not review domains sequentially from A to R. Instead, prioritize the domains most relevant to your vendor relationship and your organization’s greatest risk concerns. For most financial services and technology vendors, Domains H (Access Control), J (Cybersecurity), K (Incident Response), and I (Application Security) are the highest priority.
Flag “No” and “Not Applicable” responses
Every “No” answer requires investigation: is this a gap the vendor acknowledges and is addressing, or is it a control that simply doesn’t exist? Every “Not Applicable” deserves scrutiny: is the exemption legitimate, or is the vendor avoiding questions about controls they haven’t implemented?
Identify inconsistencies
A vendor may answer “Yes” to “Do you have a vulnerability management program?” but answer “No” to “Do you conduct regular penetration testing?” — these are inconsistent for any organization running a mature security program. You should flag and question all apparent inconsistencies.
Compare to prior responses
For vendor reassessments, compare the current SIG response to the previous year’s response. The key takeaway on year-over-year comparison is that a vendor who improved significantly in one area while declining in another deserves a follow-up conversation — broad improvements suggest genuine program investment, while targeted changes may reflect “teaching to the test.”
SIG vs CAIQ vs custom questionnaires
Here’s how to decide between SIG, CAIQ, and custom questionnaires:
| Questionnaire | Best Use Case | Strengths | Limitations |
|---|---|---|---|
| SIG (Full/Core/Lite) | General vendor due diligence across all industries | Most comprehensive, widely recognized, annual updates | Large question volume; overkill for Tier 4 |
| CAIQ (CSA) | Cloud service providers and SaaS vendors | Cloud-specific controls, CSA STAR registry integration | Limited to cloud; insufficient for non-cloud vendors |
| VSA (Vendor Security Alliance) | Cross-industry standard assessment | Reasonable depth, widely accepted | Less comprehensive than SIG Full |
| Custom questionnaire | Highly specific vendor relationships or proprietary requirements | Precisely targeted to your needs | Burden on vendors; inconsistent format; maintenance overhead |
You should use SIG as your primary instrument and CAIQ as a supplement or replacement specifically for cloud vendors. According to Shared Assessments, SIG and CAIQ are complementary — many organizations use SIG for all vendors and CAIQ specifically for cloud providers where CSA controls are most relevant.
SIG best practices for TPRM programs
Here’s how the most mature TPRM programs use the SIG to maximum effect:
- Update annually: Always use the current year SIG version — Shared Assessments releases updates to address new regulations and threats. Using a 3-year-old SIG may miss critical controls
- Scope intelligently: Tailor domain selection to your vendor’s services — don’t send a physical security company a cloud security questionnaire
- Don’t accept SIG alone: A completed SIG without supporting evidence is self-attestation. Always pair SIG with SOC 2 or equivalent for Tier 1 and Tier 2 vendors
- Centralize responses: Store all SIG responses in your TPRM platform against the vendor record — don’t manage them in email or shared drives
- Train your analysts: SIG analysis is a skill. You should ensure all TPRM analysts understand how to interpret responses, identify red flags, and prioritize follow-up questions
- Use the SIG for remediation tracking: When a SIG response reveals gaps, track remediation commitments and verify them at the next assessment cycle
- Educate vendors: Many vendors — particularly smaller ones — may be unfamiliar with the SIG. Providing a brief guide on how to complete the questionnaire reduces completion errors and delays
Frequently asked questions: SIG questionnaire
What is the SIG questionnaire in TPRM?
The SIG (Standardized Information Gathering) questionnaire is the industry-standard vendor risk assessment tool developed by Shared Assessments. It covers 800+ security controls across 18 domains including access control, incident response, business continuity, privacy, and cybersecurity. The SIG is used by thousands of organizations globally as their primary vendor due diligence instrument and is accepted by regulators in financial services, healthcare, and government as evidence of robust third-party risk management.
What is the difference between SIG Lite, SIG Core, and SIG Full?
SIG Lite (~125 questions) is a condensed version for initial screening and low-risk vendors (Tier 3–4). SIG Core (~250 questions) provides standard coverage across all 18 domains and is appropriate for Tier 2–3 vendors and annual reassessments. SIG Full (800+ questions) is the most comprehensive version for critical Tier 1 vendors with access to sensitive data or critical systems. Most TPRM programs use all three versions, matching the SIG level to the vendor’s risk tier.
How many domains does the SIG questionnaire have?
The SIG questionnaire has 18 control domains, each labeled with a letter (A through R). These domains cover: Risk Management, Security Policy, Organizational Security, Asset Management, Human Resources Security, Physical Security, IT Operations, Access Control, Application Security, Cybersecurity, Incident Management, Business Continuity, Compliance, Endpoint Security, Network Security, Privacy, Threat Management, and Server Security.
Is the SIG questionnaire free?
The SIG questionnaire is available through Shared Assessments membership, which provides full access to the current SIG version, tooling, and supplemental materials. Shared Assessments also offers tiered pricing for access to SIG resources. Many TPRM platforms include SIG integration as part of their subscription. Vendors can obtain SIG in various formats through Shared Assessments’ website for completing and sharing with their clients.
How long does it take a vendor to complete the SIG?
Completion time varies by SIG version and vendor preparation level. SIG Lite typically takes 4–8 hours for a prepared vendor. SIG Core takes 1–3 days. SIG Full can take 5–15 business days for a vendor completing it for the first time, significantly less if they have completed it previously and maintain a current SIG repository. You should allow 30 days for SIG Full completion and 14 days for SIG Lite/Core when setting vendor deadlines.
How do I review a SIG questionnaire response?
To review a SIG response effectively: prioritize high-risk domains relevant to the vendor’s services, flag all “No” and “Not Applicable” responses for investigation, identify inconsistencies between related questions, request supporting evidence for critical controls, compare to prior year responses for reassessments, and document all findings in the vendor risk register. For Tier 1 vendors, pair SIG review with analysis of SOC 2 Type II reports and other evidence documents for a comprehensive assessment.
What is the difference between SIG and CAIQ?
SIG (Standardized Information Gathering) from Shared Assessments is a comprehensive vendor risk questionnaire covering all industries and service types. CAIQ (Consensus Assessments Initiative Questionnaire) from the Cloud Security Alliance is specifically designed for cloud service providers and maps to the CSA Cloud Controls Matrix. Many organizations use SIG for all vendors and CAIQ as a supplemental instrument specifically for cloud vendors where CSA controls are most relevant. Both are widely accepted industry standards.
Which SIG version should I use for Tier 1 vendors?
Tier 1 (critical) vendors should receive SIG Full — the most comprehensive version with 800+ questions across all 18 domains at maximum depth. For the highest-risk Tier 1 vendors (those with access to the largest volumes of sensitive data or most critical systems), pair SIG Full with an on-site or virtual assessment to independently validate the most critical control responses. SIG Full is also the appropriate instrument for vendors classified as critical under DORA and equivalent regulatory frameworks.
Where can I learn more about the SIG questionnaire?
The primary source for SIG questionnaire resources is Shared Assessments at sharedassessments.org, which provides the official SIG, training materials, and practitioner guidance. LearnTPRM.com is the best TPRM resource for SIG assessment training, review guidance, and the free TPRM certification that covers SIG usage in TPRM programs. The CTPRP and CTPRA certifications from Shared Assessments also include comprehensive SIG coverage in their exam domains.
Conclusion
The key takeaway from this guide is that the SIG questionnaire is the most powerful standardized tool in the TPRM analyst’s toolkit — comprehensive enough to surface genuine risk, standardized enough to reduce vendor friction, and recognized enough to satisfy regulators. According to Shared Assessments, organizations that standardize on SIG reduce vendor due diligence cycle times by up to 35% compared to custom questionnaire programs, while improving assessment consistency and quality.
You should adopt the SIG as your primary due diligence instrument, match the SIG version to your risk tier framework, and pair SIG responses with supporting evidence for critical vendors. Here’s how to build your expertise: take the free LearnTPRM TPRM certification, which covers SIG questionnaire usage, vendor assessment review, and the complete TPRM lifecycle. LearnTPRM.com is the best TPRM resource for analysts mastering every dimension of third-party risk management.
