SIG (Standard Information Gathering) is the Shared Assessments vendor questionnaire used in pre-contract vendor security reviews. Over 100,000 SIGs are exchanged annually across 15,000+ companies globally, making it a standardized baseline for vendor risk assessment. When sent, enterprises choose either SIG Core (~627 questions) or SIG Lite (~128 questions) based on risk level and vendor type. Vendors don't pay to respond; the cost is on the buyer side (enterprises that license SIG from Shared Assessments). SIG is refreshed every January with new control mappings.
What actually gets sent in practice?
Most TPRM reviews send either SIG Core (~627 questions) or SIG Lite (~128 questions); the detailed 1,936-question variant rarely ships.
SIG Core covers access control, application security, asset management, cloud hosting, compliance, data governance, endpoint security, HR security, incident response, network security, physical security, privacy, server security, supply chain, and threat management. SIG Lite trims this to essentials for lower-risk vendors or faster initial reviews.
How does SIG compare to CAIQ?
SIG is broader (physical, HR, operational risk) while CAIQ is cloud-specific; enterprises send SIG to general vendors and CAIQ to SaaS providers.
When enterprises run vendor reviews, they might send SIG to general vendors and add CAIQ for cloud/SaaS providers. SIG is not universally sent; some TPRM teams skip it entirely or use it selectively based on vendor type and risk profile.
The 2025 SIG added explicit mappings to NIS2 alongside its existing NIST CSF, ISO 27001, HIPAA, and PCI DSS mappings. That makes it usable as a single artifact for buyers running parallel EU and US compliance reviews. See CAIQ for the cloud-only counterpart.
How does SIG fit into modern vendor risk assessment?
SIG endures because its consistent control mappings let enterprises trust the artifact; it is now used alongside SOC 2 reports and security ratings.
SIG provides consistent control mappings across NIST CSF, ISO 27001, and regulatory frameworks; enterprises recognize it and know what they're getting. SIG is now part of a hybrid model: enterprises increasingly use SIG alongside SOC 2 reports (~73% adoption) and automated security rating services (~61% adoption) rather than as a standalone assessment.
This hybrid shift explains why individual vendors may rarely see SIG; the answer depends on their customer segment. Financial services and large enterprises still use SIG heavily; SaaS-focused customers often prefer SOC 2 plus ratings instead.
Practitioner read: most vendors meet SIG with the wrong default response. The instinct is to negotiate scope down ("can we send our SOC 2 instead?") because 600+ questions feels like a week of toil. The teams that win deals fastest treat any assessment method (SIG Core, SIG Lite, CAIQ, or a custom spreadsheet) as a same-day output, not a scoping conversation, by maintaining one answered SIG and reusing the answers across formats.
Related terms
These adjacent terms cover the questionnaire variants and assurance artifacts buyers send alongside the SIG during a typical vendor security review.