Draft
What is the SIG questionnaire?
By The Citesheet team · Published
Short answer
The SIG (Standardized Information Gathering questionnaire) is a third-party risk questionnaire published by Shared Assessments. It comes in a short SIG Lite and a comprehensive SIG Core, is updated every year, is licensed rather than free, and is provided in Excel. Banks, insurers and other large enterprises often send it to their vendors.
The SIG (Standardized Information Gathering questionnaire) is a vendor risk questionnaire published by Shared Assessments, a membership organization for third-party risk management. Large buyers use it to assess the companies they buy from.
Key facts (from Shared Assessments, as of 2026-10-20)
- Two standard sizes. The SIG Lite is for "a basic level of assessment due diligence"; the SIG Core is "a comprehensive, risk-based assessment of a service provider" (About the SIG). In the 2023 edition, the Lite had 126 questions and the Core 855.
- Updated yearly. The SIG is updated at least annually, so counts and wording change between editions.
- Licensed. It is not free to download: members get it, and others can subscribe.
- Excel. Shared Assessments provides the SIG in Microsoft Excel.
What it means for a vendor
You don't choose the SIG; the buyer sends it, often scoped to the risk you pose to them. Ask which version and year they are using. Our guide to SIG Lite vs SIG Core explains the difference and why online question counts disagree.
Sources
- Shared Assessments: About the SIG (accessed )
- Shared Assessments: SIG FAQ (accessed )