SIG Questionnaire
The Shared Assessments SIG is a standardized questionnaire for evaluating third-party technology, security, privacy, resilience, and operational risk.
Definition
The Standardized Information Gathering (SIG) questionnaire is a third-party risk assessment instrument published by Shared Assessments. Current SIG tooling supports standardized scoping and buyer customization, so respondents should identify the release, template, and buyer-specific changes before reusing prior answers.
Context
SIG content spans cybersecurity, information technology, privacy, data governance, business resilience, and other third-party risk areas. Shared Assessments updates the content over time and provides SIG management tooling, which means the exact release and scoping choices matter more than an unqualified question or domain count.
Why it matters
Record the SIG release, scoping template, buyer customization, source filename, and required output before automation. A response library built for another release or scope can suggest useful evidence, but it should not silently overwrite the buyer's wording or instructions.
Map approved answers to current evidence, owner, review date, and applicable product scope. When a source policy, control, audit period, architecture, or legal commitment changes, revalidate the affected response before it is reused.
Treat import and export fidelity as acceptance criteria. Verify question identifiers, section structure, formulas, protected areas, conditional fields, and required answer columns against the buyer's original workbook.
Reviewed primary sources
The definition above distinguishes the current publishers and artifacts using these primary sources.