What Is a SIG Questionnaire? A Practitioner's Guide (And A Rant)

The SIG is a vendor security questionnaire from Shared Assessments. The 2025 SIG Core has 627 questions across 21 risk domains. The license costs $7,000 a year, paid by the buyer who wants to send the questionnaire. Vendors responding to one do not pay anything.

SIG (Standard Information Gathering) is the vendor security questionnaire maintained by Shared Assessments, a member-funded TPRM consortium that has been selling generic security questions to enterprises since 2005. The 2025 release ships in three sizes (SIG Lite, SIG Core, SIG Detail) and gets a refresh every January. The buyer pays the license. The vendor receives the workbook and fills it out for free.

I am going to be opinionated about this one. I spent a decade as a CISO answering vendor security questionnaires before I built a tool to answer them, and the SIG is the artifact I have the strongest opinion on. My problem is the combination of the price and the questions.

Vendor security questionnaires are the wrong answer to the wrong question. The question buyers think they are asking is: "is there something I can ask that will tell me whether this vendor is going to get breached?" The honest answer is no. Pick any major breach in the last year and ask which question on a SIG would have surfaced it before it happened. You will not find one. The questions filter for whether a topic exists in your org, not for whether your security actually works.

So you are buying a list of questions that would not have caught the breach. And you are paying for it on top of free alternatives. The CSA's CAIQ is free, ships as an Excel download, and covers most of the same control surface for cloud and SaaS. Most teams that have been doing TPRM for more than a year already have an internal questionnaire that covers 80 percent of the same ground. Add the part most security people will admit privately but not in writing, that buyers rarely act on questionnaire answers unless a vendor says "no" to a question almost no vendor says "no" to, and the case for paying $7,000 a year for the questions thins out fast.

What is a SIG, actually?

The SIG is a 627-question Excel workbook Fortune 1000 procurement uses to evaluate vendor security. It is a branded checklist with a $7,000 license.

Strip away the branding and the SIG is a list of questions phrased so broadly that no responsible vendor will ever answer "no" to any of them. A few real examples from SIG Core:

• "Do you have business continuity and disaster recovery plans developed, documented, and tested for all critical business functions and systems?"
• "Are there documented policies to ensure compliance with relevant legal, regulatory, and contractual requirements?"
• "Are firewalls, intrusion detection, and other network security controls implemented to protect against external threats?"

Every vendor with a heartbeat answers yes to those. The honest answer for most is closer to "we have something on paper and have not really tested it." The difference between a well-configured DR plan that survives a real outage and a Confluence page someone wrote two years ago is the difference between night and day, and the SIG cannot tell them apart. The questions filter for whether the topic exists in your org, not for whether your security actually works.

That is the structural problem with questionnaires in general, not just the SIG. They ask "can you check the box" instead of "does this configuration protect against the threats my buyer actually has." Real security work happens in the configuration. The SIG asks about presence.

Shared Assessments has done a real job of getting their template adopted as the default in enterprise procurement intake. That is genuine work, and the consortium deserves credit for it. But the artifact you are buying for $7,000 a year is buyer-side brand recognition, not security expertise. Be clear-eyed about which one you are paying for.

What's in the 2025 SIG?

The 2025 SIG ships as a Workbook in three depth tiers (Lite, Core, Detail) with 21 risk domains and refreshed mappings to NIST CSF 2.0 and DORA.

Per the Shared Assessments product page, the 2025 risk domains include Access Control, Application Management, Artificial Intelligence, Asset and Information Management, Cloud Services, Compliance Management, Cybersecurity Incident Management, Endpoint Security, Enterprise Risk Management, ESG, Human Resources Security, Information Assurance, IT Operations Management, Network Security, Nth Party Management, Operational Resilience, Physical and Environmental Security, Privacy Management, Server Security, Supply Chain Risk Management, and Threat Management.

The 2025 update added new questions to Cybersecurity Incident Management (5 questions on incident response and outsourced reporting), Operational Resilience (4 questions on contingency planning and data governance), and Information Assurance (3 questions). It also added DORA, NIS2, and NIST CSF 2.0 to the mappings list (Shared Assessments, October 2024). None of those additions are revolutionary. They are the questions any working security team would have added themselves after reading the relevant regulations.

SIG Lite vs SIG Core vs SIG Detail: which one do buyers actually send?

SIG Lite (128 questions) goes to mid-market buyers, SIG Core (627) to Fortune 1000 TPRM programs, and SIG Detail (1,936) to regulated industries.

In our customer base, SIG Lite shows up on roughly 70% of inbound requests, SIG Core on 25%, and SIG Detail on the remaining 5% (mostly financial-services and federal-adjacent buyers). If your buyer mix is mid-market SaaS, you will rarely see anything past SIG Lite. The full breakdown of when each variant shows up sits in SIG vs SIG Lite vs SIG Core.

Question counts come from the Shared Assessments 2025 SIG announcement. Time-to-complete medians come from our 2026 review of 142 customer responses.

What does the SIG cost in 2026?

The buyer-side SIG license is $7,000 a year, free to Shared Assessments members. Vendors responding to a SIG do not pay a license fee.

The standalone license covers the SIG Manager tool, the Workbook, the User Procedure Guide, and access to the annual content refresh. Membership at most large enterprises includes SIG access through a parent. Smaller buyers (the side asking the questions) typically buy the standalone license when their procurement program standardizes on SIG-format intake. Pricing is on the Shared Assessments SIG page directly. Multi-year pricing is "available on request," which is a polite way of saying "we will negotiate if you push."

If you are on the vendor side and a buyer sent you a SIG, you do not need to buy a license to respond. The questions arrive in your inbox in the workbook the buyer sends; that is all the access you need. Vendors only see a $7,000 invoice if they decide to license the SIG for their own internal use, which is rarely a smart move (more on that below).

Why do companies pay $7,000 a year for a list of questions?

The honest answer: brand recognition. Buyers ask for "the SIG" by name, and procurement teams want a SIG-formatted artifact in their inbox.

Strip the SIG down to question text alone and most of the 627 SIG Core questions are 100-level controls any competent security team has internal documentation for. A senior engineer could write an internal 60-question questionnaire that covers the same control surface in an afternoon. The "consortium coordination" framing oversells what is, structurally, a curated list of standard security questions with a brand attached.

The mapping argument is where the marketing gets least honest. Shared Assessments markets annual crosswalks of SIG questions to NIST CSF 2.0, ISO 27001:2022, PCI DSS 4.0, NIS2, DORA, and HIPAA. Every one of those crosswalks is duplicated free elsewhere:

• The CSA's Cloud Controls Matrix ships free mappings to ISO 27001/27002/27017/27018, NIST 800-53, NIST CSF, SOC 2 TSC, PCI DSS, HIPAA, GDPR, FedRAMP, and ENISA.
• NIST CSF 2.0 publishes free informative references to NIST 800-53, ISO 27001:2022, and COBIT.
• The CIS Controls ships free crosswalks to NIST CSF, ISO 27001, NIST 800-53, and PCI DSS.

If the mapping work were the genuine value, Shared Assessments would be charging for what nobody else delivers. They are charging for what every major framework body delivers free.

What you are paying for is the brand. If a Fortune 100 procurement team's intake form says "attach your most recent SIG Core response," answering "we have an internal questionnaire that covers the same controls" creates friction in a meeting where the buyer wants to check a box and move on. That is real friction, and the license is the cost of avoiding it. Whether $7,000 a year is worth it to you is your call. Just be honest with yourself: you are buying buyer-side recognition, not the questions and not the mappings.

The deeper problem with the SIG, and the part that gets the least attention, is that generic questions cannot stay relevant to your actual environment. The SIG asks the same encryption-at-rest question of a VPN appliance vendor, a marketing analytics SaaS, and a clinical-data platform. The buyer's actual risk model for each is different. The questions are the same. Most reviews end up with a vendor's correctly-completed SIG and a buyer's still-unanswered "but how does this apply to us?" The right thing to do is map your own environment to the controls a buyer cares about, not buy a generic template and hope the cell colors line up. The SIG works against that habit.

And if you are the buyer, the math gets weirder still. You are paying Shared Assessments $7,000 to $11,000 a year to tell you what questions to ask your own vendors. Nobody knows your threat model better than you do. If your vendor hosts your data in AWS, "do you encrypt data at rest?" is a checkbox question whose realistic failure mode is "someone walks out of an AWS data center with a hard drive." That threat is not in your top fifty risks. The SIG asks it anyway, because the SIG is generic and your environment is not. Paying a consortium to author the questions you should be authoring yourself is paying to outsource the part of TPRM that is actually your job.

I am sure you can find any number of specific SIG questions online and pull on them. The questions themselves are mostly fine, in the sense that they are real security questions someone would ask. The argument is not that the questions are wrong. The argument is that paying someone else to author the questions you should already know to ask, when public frameworks already publish those questions for free, is structurally backwards.

How is the SIG different from CAIQ?

The paid SIG and the free CAIQ cover near-identical control surface for SaaS and cloud vendors; the gaps are mostly enterprise-governance trivia.

Full glossary entries at SIG and CAIQ. For a cloud or SaaS vendor, CAIQ covers 85 to 95 percent of SIG Core's relevant control surface across 17 Cloud Controls Matrix domains. The SIG-only ground is enterprise-governance trivia (parent company structure, financial stability, M&A history) and a few HR-policy specifics tangential to product security. CAIQ is also publishable to the public CSA STAR Registry for free, where buyers pull it directly without sending you anything.

For a SaaS vendor, the security control surface CAIQ already covers is everything a SIG Core would actually evaluate. Buyers send the SIG anyway because their procurement intake form has "SIG" written on it. Most teams end up answering both, which is exactly the problem why questionnaires break sales cycles documents.

If I were building a buyer-side TPRM program from scratch in 2026, I would standardize on CAIQ for cloud vendors, pull SOC 2 reports for evidence, and write a 30-question custom questionnaire for the buyer-specific scoping that no template covers. I would not pay $7,000 a year for a brand. But I am not procurement at JPMorgan, and procurement at JPMorgan has its own incentives.

How do buyers actually send a SIG?

Buyers email the Workbook (an Excel file), upload it to a TPRM portal like OneTrust or Archer, or send a custom-scoped subset of SIG Core questions.

The Workbook is the most common delivery for first-time reviews. Portal-based delivery has grown to roughly 40% of inbound questionnaires we see in 2026, up from 12% in 2022, driven by enterprise TPRM teams standardizing on a single intake tool. Custom-scoped subsets, where the buyer pulls 80 questions from SIG Core relevant to their data sensitivity, are the third path. Same source content, three delivery formats, and only one of them lets you import your last response cleanly. (Portals do not.)

How do you respond to a SIG without paying the SIG tax?

Treat your security posture as one answerable structure, then map it onto whatever format the buyer sends. Senior time goes to scoping.

The deeper point first. Every SIG question is asking about something that already exists somewhere in your stack. Your SOC 2 report has the encryption answer. Your IR runbook has the incident response answer. Your SSO config has the access control answer. The questionnaire is just a request for those answers in whatever format the buyer chose. Build the source of truth once; let the format change.

The wrong move is to spend senior engineering time copy-pasting from one Excel column to another every time a new SIG arrives. The right move is to ground every answer in your live evidence (policies, configs, audit reports) so a new questionnaire does not require new work. Tools like Evident do this end-to-end; the principle holds with or without a tool.

For a starting structure, our SOC 2 questionnaire checklist covers the same source-of-truth pattern from the SOC 2 angle. The pattern transfers directly.

Should a vendor ever buy a SIG license?

For most vendors, no. Responding to a SIG does not require a license; the buyer's workbook arrives in your inbox and you answer the questions in it.

The narrow scenario people occasionally raise is using SIG question text to author internal due-diligence assessments of their own sub-processors, or wiring SIG Manager into their compliance tooling. Both are rare, both have free alternatives. CAIQ ships free as an Excel download and covers 85 to 95 percent of the same control surface for SaaS or cloud vendors. The public CSA STAR Registry is also free and full of completed CAIQ submissions you can use as reference. None of those require sending Shared Assessments $7,000 a year.

$7,000 a year on questions that are extremely unlikely to change the outcome of your security program could be spent on a lot of other things. Tuesday donuts for the team for two years, for example.

How does the SIG relate to TPRM, SOC 2, and ISO 27001?

The SIG is the questionnaire artifact in a TPRM program; SOC 2 and ISO 27001 are the audit reports the SIG cites as evidence in answers.

Full glossary entries at TPRM, SOC 2, and ISO 27001. A clean response stack: a current SOC 2 Type II report, an ISO 27001:2022 certificate (if you have international buyers), a recent penetration test attestation, a SIG Core or SIG Lite response keyed to the buyer's scoping, and a trust center that exposes the same answers buyers will ask for in the next questionnaire. The SIG is the request channel; the certifications are the supporting evidence. The NIST CSF 2.0 mapping in the 2025 SIG ties the questionnaire questions back to the framework controls your audit reports already cover.

Frequently asked questions

These are the questions buyers and prospective vendors ask most often about the SIG, what it costs, and how it sits alongside other artifacts.

Is the SIG free?

It depends which side you are on. If you are a vendor responding to a SIG someone sent you, yes, it is free; the buyer who sent it is the licensee. If you want to be the side asking the questions, the standalone SIG license runs $7,000 a year (Shared Assessments) on top of any membership dues. CAIQ already exists, is free, and covers the questions worth asking for cloud and SaaS vendors.

Who created the SIG and who maintains it?

The SIG is maintained by Shared Assessments, a TPRM industry consortium founded in 2005 by a working group of US banks (BITS / The Financial Services Roundtable). The consortium publishes annual updates each January and runs a member feedback cycle that drives content changes.

How long does a SIG Core response take?

A first-time SIG Core (627 questions) typically runs multiple weeks of cross-functional effort without automation. SIG Lite (128 questions) takes around 48 hours of SME time without automation. With a tool like Evident that maps to your live evidence, response time on either drops to about an hour.

Does the SIG replace SOC 2 or ISO 27001?

No. The SIG is a buyer's questionnaire, not an attestation. SOC 2 (an AICPA audit report) and ISO 27001 (a certification against an international standard) are independent third-party verification of your controls. Most SIG responses cite the SOC 2 report as evidence for individual answers.

Can I respond to a SIG without buying the license?

Yes. Vendors do not need to license the SIG to fill it out; the licensed buyer sends the questionnaire and you complete it. Vendors only need the license if they want to use the SIG question library to author internal assessments or pre-populate trust-center content, neither of which is a strong reason to buy.

What changed in the 2025 SIG Core?

The 2025 SIG Core kept the 627-question structure but added 12 new questions (Cybersecurity Incident Management, Operational Resilience, Information Assurance), added DORA / NIS2 / NIST CSF 2.0 to the mappings, and refreshed existing mappings against PCI DSS 4.0 and ISO 27001:2022 (Shared Assessments).