Popular Posts

The Most Common Third-Party Cyber Gaps Revealed

4 Ways to See if You Are at Risk of a Vendor…

The SIG, short for “Standardized Information Gathering (Questionnaire)” is a repository of third-party information security and privacy questions, indexed to multiple regulations and control frameworks. SIG is published by a non-profit called Shared Assessments, and has been in existence for about 12 years. The SIG has become such a popular means to assess vendor security risk that more than 15,000 people worldwide are utilizing this security questionnaire.
Shared Assessments updates the SIG every year, reflecting new security and privacy challenges, changes to regulations and the latest trends and newest best practices in third-party risk management. Updates to the SIG usually have new questions, rewordings to old questions, deleted questions and reordering of the question sequence.
SIG users will “scope” their own questionnaire from the 1,200 question repository. Many licensees will use one of the two standard “scopings,” SIG Lite (~150 questions) and SIG Core (~825 questions). Others may add more questions from the repository or even their own business- or industry-specific questions.
Shared Assessments is a non-profit member-driven organization. The members determine how Shared Assessments will evolve the SIG each year, by voicing their opinions in committee meetings. These meetings are generally held each month, and the discussions drive how the Shared Assessments team will update the SIG content.
The Standardized Information Gathering (SIG) Core questionnaire includes approximately 850 questions that target all 18 risk controls. Its purpose is to help give an in-depth understanding about how a third party secures information and services. Based on industry standards, it’s meant to cover nearly all third-party risk assessments.
The Standardized Information Gathering (SIG) Lite questionnaire includes about 330 questions. Its purpose is to provide a broad, high level overview about a third party’s internal information security controls. This tool provides a basic level of due diligence and may be used as a starting point, before proceeding with a more detailed security review.
The SIG is becoming increasingly common in the UK, EU, the Far East and the US, across a number of industries, including many large US banks. Increasingly, large US vendors are adopting SIG. They in turn are requesting that customers and prospects accept their SIG in place of proprietary evaluator questionnaires.
SIG reflects the combined knowledge and experience of hundreds of member organizations over more than ten years.
Because SIG is indexed to many standards (ISO 27002:2013, ISA 62443, FFIEC Appendix J, FFIEC CAT, PCI DSS, FFIEC IT Management Handbook, EBA Guidelines, NIST SP 800-53 Rev 4/5, NIST CSF, HIPAA, GDPR, NYDFS 23 NYCRR 500 and CSA Cloud Controls Matrix, it makes compliance simpler. Choose a given control from any one of these, and you will find the SIG questions that address it.
The SIG measures security risks across 18 risk control areas within a supplier’s environment including:
Typically, scoping the SIG questionnaire results in generation of an Excel spreadsheet, which becomes a supplier questionnaire. With Panorays, however, this part of the process is completely automated.
Users of the Panorays platform benefit from:
Interested in automating your third-party security evaluation using SIG? Watch a video tutorial here to see how Panorays can help.