The SIG, short for “Standardized Information Gathering (Questionnaire)” is a repository of third-party information security and privacy questions, indexed to multiple regulations and control frameworks. SIG is published by a non-profit called Shared Assessments, and has been in existence for about 12 years. The SIG has become such a popular means to assess vendor security risk that more than 15,000 people worldwide are utilizing this security questionnaire.

Shared Assessments updates the SIG every year, reflecting new security and privacy challenges, changes to regulations and the latest trends and newest best practices in third-party risk management. Updates to the SIG usually have new questions, rewordings to old questions, deleted questions and reordering of the question sequence.

SIG users will “scope” their own questionnaire from the 1,200 question repository. Many licensees will use one of the two standard “scopings,” SIG Lite (~150 questions) and SIG Core (~825 questions). Others may add more questions from the repository or even their own business- or industry-specific questions.

What is Shared Assessments?

Shared Assessments is a non-profit member-driven organization. The members determine how Shared Assessments will evolve the SIG each year, by voicing their opinions in committee meetings. These meetings are generally held each month, and the discussions drive how the Shared Assessments team will update the SIG content. 

What are the types of SIG questionnaires?

• SIG Core questionnaire

The Standardized Information Gathering (SIG) Core questionnaire includes approximately 850 questions that target all 18 risk controls. Its purpose is to help give an in-depth understanding about how a third party secures information and services. Based on industry standards, it’s meant to cover nearly all third-party risk assessments.

• SIG Lite questionnaire

The Standardized Information Gathering (SIG) Lite questionnaire includes about 330 questions. Its purpose is to provide a broad, high level overview about a third party’s internal information security controls. This tool provides a basic level of due diligence and may be used as a starting point, before proceeding with a more detailed security review.

Who has adopted SIG?

The SIG is becoming increasingly common in the UK, EU, the Far East and the US, across a number of industries, including many large US banks. Increasingly, large US vendors are adopting SIG. They in turn are requesting that customers and prospects accept their SIG in place of proprietary evaluator questionnaires.

Why is SIG useful for an evaluating company?

SIG reflects the combined knowledge and experience of hundreds of member organizations over more than ten years. 

Because SIG is indexed to many standards (ISO 27002:2013, ISA 62443, FFIEC Appendix J, FFIEC CAT, PCI DSS, FFIEC IT Management Handbook, EBA Guidelines, NIST SP 800-53 Rev 4/5, NIST CSF, HIPAA, GDPR, NYDFS 23 NYCRR 500 and CSA Cloud Controls Matrix, it makes compliance simpler. Choose a given control from any one of these, and you will find the SIG questions that address it.

The SIG measures security risks across 18 risk control areas within a supplier’s environment including: 

• Enterprise Risk Management
• Security Policy
• Organizational Security
• Asset and Information Management
• Human Resources Security
• Physical and Environmental Security
• IT Operations Management
• Access Control
• Application Security
• Cybersecurity Incident Management
• Operational Resilience
• Compliance and Operational Risk
• Endpoint Device Security
• Network Security
• Privacy
• Threat Management
• Server Security
• Cloud Hosting Services

How can a Panorays customer take advantage of a SIG questionnaire?

Typically, scoping the SIG questionnaire results in generation of an Excel spreadsheet, which becomes a supplier questionnaire. With Panorays, however, this part of the process is completely automated. 

Users of the Panorays platform benefit from:

• Rapid supplier vetting. Our typical customer is able to vet a vendor within eight days. 
• Eliminating manual questionnaires  
• Adding business context to the SIG questionnaire, so that suppliers receive only the questions that are relevant to their particular business relationship

Interested in automating your third-party security evaluation using SIG? Watch a video tutorial here to see how Panorays can help.