SIG and SIG Lite
SIG and SIG Lite questionnaire completion
If a customer has sent you a SIG or SIG Lite workbook, we complete it from your existing security documentation, in the file they sent. Answers are tied to evidence, gaps are flagged, and you approve the final version.
What SIG is
A standard questionnaire for third-party risk.
The SIG (Standardized Information Gathering questionnaire) is published by Shared Assessments and is widely used by organisations to assess the security and risk practices of their suppliers. It is organised by risk area and is normally sent as a spreadsheet workbook.
SIG Lite is a shorter version, often used for a first-pass or lower-risk assessment. Which version you receive is your customer’s choice, and the exact contents depend on the version and year they use. We complete the file you were sent rather than a version we choose.
Worklyflow is not affiliated with Shared Assessments. We help you answer the questionnaire your customer sent, from your own documentation.
Why it takes time
Breadth, not difficulty.
A SIG rarely asks anything exotic. The effort comes from its breadth: many questions across many areas of your security programme, each needing a supported answer, often with additional explanation. That pulls in people from engineering, IT, HR and legal to confirm details.
- Answers of “Yes”, “No” or “N/A” need to be backed by documents, not memory.
- Some questions cover areas your documentation only partly addresses.
- A SIG Lite answered one way and a SIG answered another undermines your credibility with the same customer.
What to send
Send the workbook as you received it.
Please don’t reformat or start filling it in. We work in your customer’s file so the response comes back in the format they expect.
The SIG or SIG Lite file
The original workbook, any instructions from the customer, the deadline and the contact who will receive it.
Security policies and procedures
Access control, incident response, backup and continuity, vulnerability management, secure development, vendor management and data handling.
Technical documentation
Architecture and hosting overviews, encryption approach, logging and monitoring.
Prior responses and reports
Earlier SIG, DDQ or CAIQ answers you have approved, and any audit reports or certifications issued to you.
How we complete it
The SIG workflow.
Confirm the version and scope
We check whether you have a SIG or a SIG Lite and which sections are in scope before drafting begins.
Map each question to your evidence
Every question is matched to the policy, procedure or technical document that answers it, or to nothing, if nothing does.
Draft in the workbook
“Yes”, “No” and “N/A” responses, and any supporting text, are entered only where your documentation supports them.
Flag the rest
Unsupported, partial and conflicting answers are marked for your review, with a note on what is needed.
You review and approve
You resolve the flagged items and approve the final answers. The completed workbook is then ready for you to return to your customer.
What we flag
Where a SIG answer needs your judgement.
- A policy states a control, but nothing shows it is operated in practice
- A response of “N/A” that depends on how your service is scoped
- Questions about subprocessors or third parties the documents don’t cover
- Frequencies and timescales that aren’t stated in your policies
- Answers that conflict between two of your own documents
Flagged items come back to you. We never fill them in to complete the workbook. This isn’t an audit, certification or legal advice.
Reuse
Approved SIG answers are useful again.
Much of a SIG overlaps with a DDQ or a CAIQ. Once you have approved an answer, it can be kept alongside its evidence and reused, after being checked against your current documents, on later questionnaires. For the whole picture, see security questionnaire completion.
Related
Related services
Request a questionnaire review
Have a SIG or SIG Lite to complete?
Tell us what you’ve received, its format and your deadline. We’ll review the scope and let you know what we need to complete it.