SIG vs SIG Lite vs SIG Core: Which Questionnaire Do Your Buyers Actually Send?

For most enterprise TPRM reviews you receive some kind of security due-diligence questionnaire. It might arrive as a custom workbook, a portal-driven set of fields, or one of the SIG variants. When it is a SIG, you are most likely to see SIG Lite (128 questions) or a custom-scoped subset of SIG Core. The full 627-question SIG Core is rarer than people think, and SIG Detail (1,936) is rarer still, mostly showing up from heavily regulated buyers.

The SIG (Standard Information Gathering) questionnaire is a vendor-assessment template from Shared Assessments that ships in three depth tiers: Lite (128 questions), Core (627), and Detail (1,936). All three pull from one shared question bank; the difference is how many questions the buyer turns on. The 2025 release dropped on the first Thursday in November 2024, with the annual refresh cadence still landing each January for downstream tooling.

What's the difference between SIG, SIG Lite, and SIG Core?

All three pull from the same Shared Assessments question bank. The variants differ in depth: 128 questions, 627 questions, and 1,936 questions on top.

The 2025 numbers come straight from Shared Assessments' own 2025 SIG announcement, which also added explicit mappings to NIS2 and DORA on top of the existing NIST CSF 2.0, ISO 27001, HIPAA, and PCI DSS coverage. Same depth tiers, broader regulatory crosswalk than 2024.

When do buyers send SIG Lite?

Buyers tend to send SIG Lite for lower-risk vendors or initial screening passes. SIG Lite is the most common SIG variant a vendor will see in 2026.

The 128 questions cover the same risk-domain categories as SIG Core (access control, asset management, BCP, incident response, and so on) without drilling into evidence-level specifics. It is essentially the high-level layer of the larger SIG question bank.

When do buyers send SIG Core?

A full 627-question SIG Core is uncommon in practice. When it shows up, it is from buyers who specifically want comprehensive coverage in writing.

The 627 questions span 21 risk domains: information security policy, access controls, asset management, business continuity, cloud hosting, compliance, cryptography, endpoint security, human resources security, incident management, network security, operations security, physical security, privacy, server security, supplier and third-party management, threat management, vulnerability management, mobile, IoT, and AI. More commonly, what arrives is a custom-scoped subset of those 627 questions filtered to whatever the buyer's risk model actually cares about.

If you do receive a full Core, the buyer expects evidence references in answer text. A control marked "Implemented" without a pointer to the relevant SOC 2 section, ISO 27001 Annex A control, or pen-test summary will get kicked back.

When (if ever) do buyers send SIG Detail?

SIG Detail is the rarest variant. It mostly shows up from heavily regulated buyers, and even those buyers do not always actually use it.

The 1,936 questions in SIG Detail are not 1,936 unique topics; they are SIG Core questions plus per-control evidence prompts ("provide the policy document, the implementation procedure, and the most recent audit attestation for this control"). It is the SIG version that asks for files, excerpts, and timestamped evidence per control.

The reason it does not get used much in practice is that it is not feasible to validate at scale. The vendor is already sending a SOC 2 Type II report and probably an ISO 27001 certificate. Detail asks for the underlying implementation details on top of that, which the buyer's review team has to read, validate, and reconcile against the audit reports. That is hours of senior-analyst time per vendor, and most TPRM programs do not have it. In practice, even buyers who request Detail end up reading the SOC 2 and skimming the rest. If your buyer is not a defense contractor, a Tier 1 bank's critical-vendor program, or a regulator-mandated process, replying with "we are happy to provide Core; here is why Detail does not add information your SOC 2 does not already cover" works often enough to be the default move.

How long does each variant actually take to complete?

Without automation, SIG Lite typically eats around 48 hours of SME time, SIG Core multiple weeks, SIG Detail longer than most vendors will agree to.

These are wall-clock estimates for a manual response with cross-functional coordination across security, legal, and engineering. The variance is huge. A vendor with a clean knowledge base and a current SOC 2 will move faster; a vendor without one can take twice as long and still produce contradictory answers across rooms by the end of it. See why questionnaires break sales cycles for the underlying volume math.

The math changes substantially with automation. With a tool like Evident that maps to your live evidence, you put the workbook in and get a complete first draft back in about an hour, on either Lite or Core. The cost drops from "several engineers spending part of their week on this" to "review a draft and approve."

What gets mapped in each variant?

All three variants map to the same control libraries: ISO 27001, NIST CSF 2.0, HIPAA, PCI DSS, and as of the 2025 release, NIS2 and DORA.

What saves vendors time is the answer reuse, not the SIG license. One well-written answer on encryption-in-transit can be cited for ISO 27001 Annex A 8.24, NIST CSF 2.0 PR.DS-02, and PCI DSS 4.0 requirement 4.2 regardless of which questionnaire the buyer sent. The actual cross-framework mappings are published free elsewhere: the CSA's Cloud Controls Matrix ships free crosswalks across most of those same frameworks, NIST CSF 2.0 publishes free informative references, and the CIS Controls ships free mappings to NIST CSF, ISO 27001, and PCI DSS. The 2025 SIG release added EU NIS2 and DORA crosswalks (Shared Assessments, October 2024), but those same regulations are also covered by free CCM and NIST mappings. Vendors selling into the EU should expect to see Core or Detail in inbound workbooks; that is a buyer-behavior fact, not a reason to license SIG yourself.

How does buyer industry affect which SIG you'll see?

Industry decides depth. SaaS buyers default to Lite or Core. Banks, brokers, payors, and federal contractors lean toward Core or Detail with add-ons.

The pattern follows two variables: the regulatory regime the buyer is subject to, and the data classification the vendor will touch. A retail SaaS buyer with no PCI scope and no PII processing rarely needs more than Lite for a marketing vendor. A clinical-data platform buyer with HIPAA obligations will send Core or Detail to anyone holding PHI for more than transit. A Tier 1 bank will send Core with custom appendices, often a regulator-specific addendum, and will route Detail to anyone in their critical-vendor tier under DORA ICT-third-party rules (DORA has been in force since January 17, 2025).

In our customer base, Core is the realistic median for B2B SaaS vendors selling above roughly $50K ACV. Below that, Lite is more common. Vendors selling into regulated financial services usually see Detail at renewal.

Where does CAIQ fit alongside SIG?

CAIQ is the cloud-vendor counterpart from the Cloud Security Alliance, and many buyers send both because the two cover overlapping ground.

The CAIQ is the questionnaire form of the CSA's Cloud Controls Matrix and is shorter than SIG Core (the 2024 CAIQ has 261 questions across 17 cloud-specific control domains, per CSA's CAIQ v4 artifacts page). Cloud-native vendors often submit a CAIQ proactively to reduce inbound SIG volume, and TPRM teams treat the CAIQ as substituting for the cloud-hosting and cryptography sections of SIG Core. It does not substitute for the rest of the SIG. See our CAIQ explainer for the full crosswalk.

Frequently asked questions

Common questions we hear from security teams trying to figure out which SIG variant to expect from a buyer and how to respond efficiently to each.

Do I need to fill out SIG Detail if a buyer asks?

Probably not. Default to pushing back unless you are selling into defense, a Fortune 100 bank's critical-vendor program, or a regulator-mandated process that actually consumes Detail-level evidence. For everyone else, your SOC 2 Type II report covers most of what Detail is asking for at the implementation layer, and the buyer's TPRM team will not realistically validate the rest. Reply with: "We can answer SIG Core; here is our SOC 2 attestation and ISO 27001 certificate for the implementation evidence." That works often enough to be the default move.

Can I respond to a SIG Core with cached answers from a previous SIG?

Yes, with two caveats. First, confirm the questions are the same SIG version (a 2024 Core answer applied to a 2025 Core question may miss a NIS2 or DORA mapping the buyer cares about). Second, refresh any answer that references a dated artifact (SOC 2 reports, pen-test summaries, certifications). Stale evidence is the most common reason a SIG response gets kicked back.

How often does Shared Assessments update SIG?

Annually. Shared Assessments publishes the new SIG version each November (the 2025 SIG dropped November 2024 per their announcement) so subscribers can plan around the calendar-year refresh. Most TPRM tools fold the new version in by January.

Is there a free SIG variant?

Not as a license. The standalone SIG license runs $7,000 a year regardless of which variant you want. That said, vendors responding to a SIG do not pay anything; the buyer who licenses it sends the workbook and the vendor answers it. If a SIG (Lite, Core, or Detail) lands in your inbox, your access is "free" in the sense that the buyer paid for it. If you want to license SIG to send to your own vendors, see what is a SIG questionnaire for why CAIQ is the better starting point.

Does CAIQ replace SIG for cloud vendors?

For some buyers, yes. Many cloud-native TPRM programs accept a current CAIQ in lieu of the cloud-hosting and cryptography sections of SIG Core, but they still want the rest of SIG (HR security, BCP, incident management, vendor management). Treat CAIQ as a partial substitute, not a full one. See the SOC 2 questionnaire checklist for how to package the two together.

What's the right SIG to fill out proactively for a trust center?

Either Lite or Core can work. Lite (128 questions) is the lower-effort option and covers the same control surface at a higher level; Core (627 questions) gives you a more complete answer to start from when a buyer sends a custom workbook. The right choice used to come down to how much engineer time you wanted to spend filling one out. With automation that calculus shifts: a tool like Evident can fill either against your live evidence in about an hour, so you can keep both prefilled and pick whichever the buyer wants to receive. For background on why centralized answer libraries matter at all, see TPRM and why questionnaires break sales cycles.

For more reference on the underlying frameworks, the NIST Cybersecurity Framework page at csrc.nist.gov and the ISO 27001 standard page at iso.org are the two primary sources buyers will most often cite back at you in clarification questions. Keep both bookmarked; you will need them on every SIG Core you fill out.