SIG Lite vs SIG Core: which security questionnaire is which?
By The Citesheet team · Published
Short answer
SIG Lite and SIG Core are two sizes of the same vendor security questionnaire, the Standardized Information Gathering (SIG) questionnaire from Shared Assessments. SIG Lite is the short version for lower-risk vendors: Shared Assessments described the 2023 edition as 126 questions. SIG Core is the comprehensive version for vendors that handle sensitive data or critical services: 855 questions in 2023. The SIG is updated every year and buyers can scope it, so the file you receive may not match either number.
If a customer has sent you "the SIG," the first thing to find out is which one. SIG Lite and SIG Core are two sizes of the same questionnaire, and the difference is several hundred questions.
The short version
| Detail | SIG Lite | SIG Core |
|---|---|---|
| What it is | The short, "basic level" version | The full, comprehensive version |
| Questions (2023 edition, per Shared Assessments) | 126 | 855 |
| Typical use | Lower-risk vendors, first screening | Vendors that store or process sensitive data, or provide critical services |
| Format | Microsoft Excel | Microsoft Excel |
| Published by | Shared Assessments | Shared Assessments |
Shared Assessments describes the SIG Lite as for organizations needing "a basic level of assessment due diligence," and the SIG Core as "a comprehensive, risk-based assessment of a service provider" (About the SIG). Its FAQ puts it more simply: the Lite is a foundation of low-risk questions, and the Core is the comprehensive set (SIG FAQ).
What the SIG is
The SIG (Standardized Information Gathering questionnaire) is a third-party risk questionnaire published by Shared Assessments, an industry membership group. Banks, insurers and other large enterprises often use it to assess their vendors.
A few facts that explain how it behaves in practice, all from Shared Assessments' own pages as of 2026-10-20:
- It comes from a larger library. The SIG Content Library had 1,855 risk control questions across 19 risk domains in 2023, far more than either the Lite or the Core contains. As we read it, the Lite and the Core are standard selections from that library.
- It changes every year. The SIG is updated at least annually, and the FAQ says content follows an annual release cycle.
- It is licensed, not free. The SIG is not free to download. Members get it; others can use it through an annual subscription.
- It is an Excel tool. Shared Assessments provides the SIG products in Microsoft Excel, and buyers can add their own custom questions.
Why the question counts you read online disagree
Search for SIG question counts and you'll find different numbers. Mitratech, for example, describes the SIG Lite as 133 questions and the SIG Core as 810 questions across 21 risk topics, while Shared Assessments' own page gives 126 and 855 for 2023. ComplyDog's comparison notes the same disagreement for SIG Core.
There are three likely reasons:
- Different years. Each annual edition changes the questions. A count is only meaningful with its year.
- Scoping. Buyers can switch domains on or off and add custom questions, so "a SIG Core" from one buyer may not match one from another.
- Copying. Many articles repeat a number from an older article without a year.
The practical takeaway: count the rows in the file you actually received, and check its version on the cover tab.
Which one will I get?
You don't choose; the buyer does, usually based on how risky they think your service is:
- Probably the Lite if you don't store their sensitive data, aren't critical to their operations, or are early in their review.
- Probably the Core if you will hold customer or regulated data, connect to their systems, or provide something they can't easily replace.
Some buyers start with the Lite and send the Core (or follow-up questions) once the deal grows. Ask which version and which year they are using, and whether they have scoped out any domains. It changes your workload a lot.
How to answer either one
The approach is the same as for any security questionnaire:
- Answer from your written policies, not memory. Find the sentence that proves each answer.
- Say No or Partially where that's the truth, with a short explanation and a date if you plan to fix it. See answering without SOC 2.
- Use N/A only where the topic truly doesn't apply (for example, physical data center questions if you run entirely on a cloud provider), and say why.
- Keep the buyer's file intact. SIG files have dropdowns and scoring formulas. Fill in their cells; don't rebuild the sheet.
- Reuse carefully. A Lite you answered last year covers many of the same topics as a Core, so it is a head start. Check that each answer is still true and that the new question asks the same thing.
How Citesheet helps
We have measured Citesheet on the CAIQ only, not on the SIG, so we don't claim SIG support. If you've been sent a SIG in Excel, you can send it with your policies and we'll tell you honestly how it does.