SIG Questionnaire

What is the SIG questionnaire?

The SIG (Standardized Information Gathering questionnaire) is a standard set of vendor risk questions from Shared Assessments, a membership organization for third-party risk management. You send it to a vendor (the company that sells you a product or service) to learn how it protects data and keeps running. It is one of the most common forms of security questionnaire.

The questions sit in 21 risk domains. They include access control, artificial intelligence, cloud services, privacy management, operational resilience and Nth party management, which covers the vendor's own vendors. Many questions map to outside standards and laws, such as ISO 27001, the NIST Cybersecurity Framework 2.0, GDPR and the Cloud Security Alliance's CAIQ.

The SIG is licensed, not free. Shared Assessments sells it on its own and includes it with membership.

SIG Lite vs SIG Core

Whoever sends the SIG picks how deep it goes, based on how risky the vendor is. The 2025 SIG, the last with published counts, came in three levels:

• SIG Lite: 128 questions for vendors that need basic due diligence, or as a first pass before a deeper review.
• SIG Core: 627 questions for vendors that handle highly sensitive or regulated information.
• SIG Detail: the full library of 1,936 questions, which you can cut down by risk domain, regulation or control family.

You can also mix levels, for example Core questions for privacy and Lite questions for everything else.

Versions and recent changes

Shared Assessments updates the SIG every year, and each release carries the next year's name. The 2026 SIG was scheduled for September 19, 2025. It added references to ISO 42001, the AI management system standard, and more detailed mapping to NIST SP 800-171.

In March 2026, Shared Assessments announced SIG EV, a browser-based way to build, send and score the SIG. It says the content and methodology are unchanged, and the Excel workbook stays available. As of October 2026, Shared Assessments has announced its 2027 release, which it says adds EU AI Act alignment and refreshed cybersecurity supply chain guidance.

What it looks like in a vendor's terms

A vendor's security addendum or DPA may limit how many questionnaires it will answer. A typical clause reads like this:

Upon Customer's written request, and no more than once per year, Provider will complete an industry-standard security questionnaire or provide its most recently completed questionnaire. Provider's responses are Provider's Confidential Information.

• "No more than once per year": one questionnaire a year, not one per team or per renewal.
• "Industry-standard": the vendor may hand you its existing SIG instead of answering your own form.
• "Most recently completed": the answers may be months old.
• "Confidential Information": the answers fall under the confidentiality clause, so check before you share them outside your company.

Why it matters to you

A completed SIG can save weeks. Some vendors keep one ready. Zoom, for example, says its SIG is the first step its commercial customers use to assess its security risk. Asking for an existing SIG before you send your own questions is often the fastest route.

It works the other way too. Your own customers may send you a SIG, and some of its questions are about your vendors. What you can answer depends on what your vendors told you.

Keep in mind that a SIG is the vendor's own answers on the day it filled them in. Back the important ones with evidence, such as a SOC 2 report.

What to check

• Version: which year's SIG the vendor answered. Each release changes questions and mappings; the 2026 SIG added ISO 42001 references and the coming 2027 release adds EU AI Act alignment.
• Level: Lite or Core. A SIG Lite from a vendor that holds your customers' personal data may be too thin.
• Scope: which products and company entities the answers cover. Zoom's page, for example, lists the products its SIG covers.
• Nth parties: the answers about the vendor's own vendors, and whether they match its subprocessor list.
• "No" answers: each one, and what the vendor does instead.
• Date: when it was completed. Ask for a fresh one at your annual vendor review.

How Venpo helps

A SIG records what a vendor said on one day. Venpo watches the public documents behind many of those answers, such as the vendor's DPA, privacy policy, subprocessor list and AI policies, and emails you a plain-English alert when one changes. That tells you when a SIG answer about data use or subprocessors may be out of date.

The Fine Print Scan answers some of the same questions straight from vendors' documents: how many companies have your data, whether it goes to China or other restricted countries, and whether vendors keep it after you cancel.