SIG Lite

The shorter version of the Standardized Information Gathering questionnaire, a third-party risk questionnaire published by Shared Assessments.

The SIG is a widely used vendor risk questionnaire, licensed by Shared Assessments and updated each year. SIG Lite is a shorter version for lower-risk vendors or a first pass; SIG Core is the fuller version.

Financial services and larger enterprises often send it. Many of its questions, such as access control, encryption and incident response, are answered by a well-maintained trust center.

What a reviewer wants to see

• A completed SIG Lite, or answers mapped to it
• Supporting documents for the answers that need them