SIG and SIG Lite, and how to get through one
The Standardized Information Gathering questionnaire is Shared Assessments' third-party risk form. It is the longest of the common assessments, and the one most likely to arrive with a deadline attached.
In short
SIG comes in sizes. SIG Lite is the shortened version most vendors receive — a few hundred questions across the usual risk domains. The full SIG is several times larger. Both arrive as multi-tab Excel workbooks, and both phrase many controls as instructions ("Describe…", "Provide…") rather than as yes/no questions, which is why generic question-detection often misses them.
SIG & SIG Lite at a glance
| Published by | Shared Assessments |
| Versions | SIG Lite (shortened) and the full SIG; content is refreshed on an annual release cycle |
| Typical size | SIG Lite runs to a few hundred questions; the full SIG is substantially larger |
| Format | Excel workbook, multiple sheets, often with dropdown-source and scoring tabs alongside the questions |
| Who asks for it | Financial services, insurance and other regulated buyers with formal third-party risk programmes |
| Phrasing | Many controls are imperative rather than interrogative — "Describe the access review process" rather than "Do you review access?" |
How the file is put together
SIG workbooks carry more scaffolding than any other common assessment, and most of it is not questions.
What Compliance Concierge does with a SIG & SIG Lite
None of this certifies you. The tool drafts answers from the documents you upload, shows the evidence behind each one, and refuses to export anything a person has not signed off. Where your documents do not cover a control, it says so instead of filling the cell.
Frequently asked
Should I fill in SIG Lite or the full SIG?+
Whichever your customer sent. If they have given you a choice, SIG Lite is the usual starting point and the full SIG is reserved for higher-risk engagements — but that is the buyer's risk call, not yours to downgrade.
Why do tools struggle with SIG files?+
Two reasons. The questions are rarely on the first sheet, and they are often not phrased as questions at all. Anything that reads sheet one and looks for question marks will come back with the cover page or with nothing.
How long does a SIG Lite take by hand?+
Teams commonly report several days for a first pass, because the work is not typing — it is finding which policy already answers each control and confirming it is still current. That search is the part worth automating; the judgement is not.
Can previous answers be reused across customers?+
Yes, and it is the main reason the second one is faster. Reviewed answers go into a library and are reapplied when a near-identical control comes up again. Anything that is not near-identical goes back through the evidence pipeline rather than being copied across.
Other assessments we cover: CAIQ v4, HECVAT, VSA. For the process itself, see the guide to answering security questionnaires.
Answer your SIG & SIG Lite with evidence
Upload your policies and the workbook. Every draft is cited from your own documents, and nothing leaves until you approve it. The first questionnaire is free.