The full SIG content library contains 1,936 questions. SIG Lite asks 128 of them. That difference is the entire point: most vendor relationships do not justify a multi-week questionnaire exchange, and SIG Lite exists so risk teams can run standardized due diligence on lower-risk vendors without burning analyst hours or vendor goodwill.
What Is SIG Lite?
SIG Lite is the streamlined version of the Standardized Information Gathering (SIG) questionnaire, the most widely used third-party risk assessment instrument in the industry. It condenses the full SIG question set into a short, high-level assessment of a vendor’s information security, privacy, and resilience controls. It is a self-assessment, not an audit: the vendor answers, the assessor evaluates, and the completed questionnaire becomes evidence of due diligence in a third-party risk management (TPRM) program.
Purpose of the SIG Lite Questionnaire
The purpose is speed with consistency. SIG Lite gives an outsourcing organization a broad understanding of a third party’s internal control environment using a standardized question set, so answers are comparable across an entire vendor portfolio. It works either as a complete assessment for low-risk vendors or as a preliminary screen that decides whether a deeper review is warranted. Because every vendor answers the same questions, risk teams can rank, tier, and triage instead of interpreting fifty differently formatted responses.
Who Created and Maintains SIG Lite?
SIG Lite is owned and maintained by Shared Assessments, a member-driven standards organization formed in 2005 when the Big Four accounting firms and six global banks set out to fix the inefficiency of every company writing its own vendor questionnaire. The SIG is developed through a formal governance process that draws on practitioner feedback and tracks evolving regulations and standards, which is a large part of why it has held its position as the de facto industry template.
SOC 2, ISO 27001 and HIPAA done for you. Fixed fee, 100% audit pass rate.
Audit-ready in 6 weeks. Not 6 months.
What’s Included in the SIG Lite Questionnaire?
Number of Questions and Structure
The 2025 release of SIG Lite contains 128 questions. The exact count shifts slightly with each annual update (recent versions have ranged from roughly 126 to 133), so always confirm the version you are working with. Questions are predominantly yes/no with room for comments and references to supporting evidence, and each question maps back to the SIG content library and to external frameworks. SIG Lite ships as a single-worksheet questionnaire, which keeps completion and review manageable.
Risk Domains Covered in SIG Lite
SIG Lite draws its questions from the same 21 risk domains that structure the entire SIG, grouped into four control areas: Governance and Risk Management, Information Protection, IT Operations and Business Resilience, and Security Incident and Threat Management. In practice, that means high-level coverage of access control, information security policy, data privacy, cloud security, business continuity, incident response, supply chain risk, human resources security, compliance management, and ESG, among others. The breadth is the same as SIG Core; the depth per domain is what gets trimmed.
Format and Delivery (Spreadsheet and Toolkit)
Historically, the SIG has been delivered as an Excel workbook generated by the SIG Manager, the macro-driven engine inside the SIG Questionnaire Toolkit that lets assessors scope, generate, store, and compare questionnaires. That is changing. In March 2026, Shared Assessments launched SIG EV (Evolution), a browser-based platform that moves questionnaire creation, distribution, comparison, and grading to the cloud while preserving the same content and methodology. Vendors can still respond in Excel, and assessors can upload completed files, so the transition does not break existing workflows.
Worth Knowing: SIG Questions & Permissions
SIG questions cannot be edited without written permission from Shared Assessments, but assessors can add up to 100 custom questions to a scoped questionnaire. That is usually enough headroom to cover industry-specific requirements without abandoning the standard.
When Should You Use SIG Lite?
Ideal Vendor Risk Scenarios
SIG Lite fits three situations well.
- First, vendors with no access to sensitive data or critical systems, where a full assessment would be disproportionate.
- Second, large vendor portfolios, where sending 600-plus questions to every supplier would stall onboarding across the board.
- Third, early-stage evaluation, where you need enough signal to decide whether a relationship is worth deeper diligence.
Low-Risk vs. High-Risk Vendor Assessments
The dividing line is data and criticality. A marketing tool that touches no customer records, a facilities contractor, or a niche SaaS product with read-only access to public data can all be assessed adequately with SIG Lite. A payroll processor, a cloud provider hosting production data, or any vendor storing regulated information under HIPAA, PCI DSS, GDPR, or GLBA should get SIG Core. Using Lite on a high-risk vendor is a documented gap waiting to be found in your next audit.
Initial vs. In-Depth Risk Screening
Many mature programs use SIG Lite as a gate rather than a destination. The Lite response feeds an initial risk score; vendors that trip defined thresholds (a missing incident response plan, no encryption at rest, no independent certification) graduate to SIG Core or a targeted domain-level assessment. This two-stage pattern keeps effort proportional to risk and gives vendors a lighter first touch.
SIG Lite vs. SIG Core: Key Differences
Both questionnaires come from the same content library and cover the same 21 risk domains. The differences are scope, depth, and effort.
Question Count and Scope
SIG Lite’s 128 questions sit at the top of the control hierarchy: does a policy exist, is a program in place, and is there independent validation? SIG Core’s 627 questions descend into how each control actually operates. Beyond both sits the full SIG Detail library of 1,936 questions, which assessors use to build custom scopes by regulation, domain, or control family.
Depth of Assessment
A SIG Lite answer tells you a vendor has an access control program. A SIG Core response tells you how privileged accounts are reviewed, how quickly access is revoked at termination, and how authentication is enforced across environments. If your obligation is to demonstrate that a vendor’s controls are designed and operating effectively, Lite alone will not carry that weight.
Typical Use Cases for Each
Use SIG Lite for onboarding screens, low-risk tiers, annual re-checks of stable low-risk vendors, and portfolio-wide baselining. Use SIG Core for vendors that store or process sensitive or regulated data, critical service providers, and any relationship where a regulator or enterprise customer expects evidence-level diligence.
Benefits of Using SIG Lite
Faster Vendor Onboarding
A prepared vendor can turn around a SIG Lite in days rather than the weeks a Core response takes, because 128 high-level questions can usually be answered by one or two people rather than a cross-functional committee. For the assessor, shorter responses mean faster review cycles and fewer stalled deals waiting on security sign-off.
Lower Resource Requirements
Both sides save effort. Vendors avoid mobilizing IT, legal, HR, and compliance for every prospect. Assessors reduce review time per vendor, which matters enormously when a lean risk team is responsible for hundreds of third parties. Verizon’s Data Breach Investigations Report has linked a substantial share of breaches to third-party access, so the pressure to assess everyone is real; SIG Lite makes broad coverage feasible.
Standardized, Industry-Recognized Framework
SIG questions map to widely adopted frameworks and regulations, including ISO 27001, the NIST Cybersecurity Framework, PCI DSS, GDPR, HIPAA, and GLBA. That mapping means a single well-maintained SIG response can evidence posture across multiple frameworks at once, and it puts SIG Lite in the same standardized category as instruments like the Cloud Security Alliance’s CAIQ, but with broader, industry-agnostic coverage.
How to Complete a SIG Lite Questionnaire
Preparing Documentation and Evidence
Before answering a single question, gather the artifacts the questions will point to: information security policies, your SOC 2 report or ISO 27001 certificate, incident response and business continuity plans, access control procedures, privacy notices, and subprocessor lists. Most SIG Lite questions can be answered directly from a reasonably mature ISMS. If the documentation does not exist, that is your real finding, and it is better discovered internally than by a prospect.
Answering Questions Efficiently
Build an answer library. The SIG’s standardization is an asset for responders too: an answer written once, kept current, and mapped to the SIG question serial numbers can be reused across every SIG Lite you receive. Assign domains to named owners (security answers access control, legal answers privacy, operations answers continuity) and have a single reviewer check the assembled response for consistency of voice and fact before it leaves the building.
Common Pitfalls to Avoid
Three mistakes recur constantly.
- Aspirational answers: claiming controls that are planned but not implemented, which unravel the moment an assessor asks for evidence.
- N/A abuse: marking questions not applicable without justification, which reads as evasion and triggers follow-up.
- And inconsistency: SIG answers that contradict your SOC 2 report exceptions or your ISO Statement of Applicability, which damages credibility across the entire response.
Important: Never answer ‘yes’ to a control question you cannot evidence on request. A truthful ‘no, with a remediation date’ costs you a scoring point; a ‘yes’ that collapses under scrutiny can cost you the deal and, in regulated relationships, create contractual misrepresentation risk.
How to Send and Evaluate a SIG Lite Questionnaire as an Assessor
Distributing the Questionnaire to Vendors
Scope and generate the questionnaire from the SIG Manager or SIG EV, set a clear deadline (two to three weeks is reasonable for a Lite), and tell the vendor what evidence, if any, you expect alongside answers. Include your escalation criteria up front so vendors understand that certain answers will trigger a deeper assessment rather than a rejection. SIG EV supports secure one-time links for vendor access; TPRM platforms can automate the same distribution at portfolio scale.
Scoring and Interpreting Responses
Score against a rubric, not a gut feeling. Binary or weighted scoring per question, rolled up by risk domain, produces a comparable rating across vendors. Weight the domains that matter most for the specific relationship: data privacy and access control for a data processor, business continuity for an operationally critical supplier. Read comments as carefully as answers; hedged language around encryption, subprocessors, or incident notification usually marks the exact spot to probe.
Follow-Up and Remediation Steps
Every gap needs a disposition: accept the risk with documented rationale, require remediation with a deadline, escalate to a SIG Core or targeted assessment, or decline the vendor. Track remediation commitments to closure rather than filing them, and feed the results back into the vendor’s risk tier so the next review cycle reflects reality.
Pro Tip: Cross-check SIG Lite Answers
Cross-check SIG Lite answers against the exceptions section of the vendor's SOC 2 Type II report before scoring. Vendors rarely lie outright, but a clean SIG answer sitting next to a related audit exception tells you exactly where the optimistic self-assessment is.
SIG Lite Update Cycle
How Often SIG Lite Is Updated
Shared Assessments updates the entire SIG annually, adding, retiring, and renumbering questions to track new regulations, threats, and standards. Question counts move accordingly, which is why quoting ‘the’ SIG Lite count without a year is a minor sin among TPRM practitioners. Always request responses on the current release; accepting a version more than a year or two old undermines comparability across your portfolio.
Recent Changes in the Latest Release
The 2026 SIG release added no new risk domains but made three substantive moves: comprehensive mapping to ISO 42001, the AI management system standard, bringing third-party AI governance into standard due diligence; enhanced mapping to NIST SP 800-171 for organizations handling Controlled Unclassified Information; and alignment with the Business Resilience Council’s Operational Resilience Framework, shifting continuity questions from recovery planning toward evidence of sustained operations. Mappings were also refreshed for the restructured ISO 27001:2022 Annex A controls. Alongside the content update, the launch of SIG EV in March 2026 marks the first delivery-model change in the SIG’s history.
Insider Note: The ISO 42001 mapping is the sleeper change in the 2026 release. Once AI governance questions exist in the standard questionnaire, not asking them starts to look like an oversight gap. Expect enterprise assessors to treat vendor AI due diligence as table stakes within a couple of assessment cycles, well ahead of any regulatory mandate forcing the issue.
SOC 2, ISO 27001 and HIPAA done for you. Fixed fee, 100% audit pass rate.
Audit-ready in 6 weeks. Not 6 months.
Best Practices for SIG Lite Assessments
Segmenting Vendors by Risk Tier
Tier vendors before choosing a questionnaire, not after. A simple three-tier model based on data sensitivity, system access, and operational criticality lets you assign SIG Lite to the low tier, SIG Core to the high tier, and a scoped custom SIG to the middle. Document the tiering criteria; auditors and enterprise customers increasingly ask why a given vendor got the light-touch treatment.
Automating Distribution and Scoring
Manual SIG handling does not scale past a few dozen vendors. Automate the mechanical layer: distribution, reminders, response collection, first-pass scoring, and flagging of answers that breach thresholds. Keep humans on interpretation, follow-up questioning, and risk acceptance decisions. That division preserves judgment where it matters while removing the spreadsheet-wrangling that consumes most TPRM analyst time.
Integrating SIG Lite With Your TPRM Program
A SIG Lite response should not live in a folder. Feed scores into vendor risk registers, tie remediation items to contract renewals, and pair point-in-time questionnaire data with continuous monitoring signals such as security ratings and breach intelligence. The questionnaire tells you what a vendor says about its controls; monitoring tells you whether the outside world agrees.
Challenges of SIG Lite (and How to Solve Them)
SIG Lite is not free: it requires a Shared Assessments subscription or membership, which smaller assessors sometimes balk at, though the cost is modest against the analyst hours a standardized instrument saves. It is shallow by design, so treat escalation paths as part of the methodology rather than a failure of it. It is a point-in-time self-assessment, which is why pairing it with continuous monitoring matters. Vendors suffer questionnaire fatigue, which an answer library and a willingness to accept a vendor’s proactively shared SIG response both ease. And version drift across a portfolio erodes comparability year by year; standardize on the current release each year and migrate stored responses forward using the SIG’s built-in tools.
Tools and Automation for SIG Lite
The tooling landscape has three layers. Shared Assessments’ own stack, the SIG Manager workbook, and now SIG EV, handles creation, comparison, and grading. TPRM and VRM platforms embed licensed SIG content and automate the full assessment lifecycle, from distribution through remediation tracking, with SIG answers mapped automatically to frameworks like ISO 27001 and NIST. And on the vendor side, security questionnaire automation tools draft SIG responses from an organization’s existing documentation and prior answers, cutting response time from days to hours. Whichever layer you invest in, the standard itself stays the same, which is precisely what makes the automation reliable.
SIG Lite earns its place by matching assessment effort to actual risk: 128 standardized questions, 21 risk domains, annual updates, and an ecosystem of tooling that both sides of the assessment already understand. Use it as the broad, fast layer of a tiered TPRM program, escalate to SIG Core when data sensitivity demands it, and keep responses current with each annual release.
Frequently Asked Questions
How many questions are in SIG Lite?
The 2025 release contains 128 questions. The count changes slightly with each annual update, so check the version year before quoting a number.
Is SIG Lite free to use?
No. The SIG, including SIG Lite, is a licensed product available through a Shared Assessments subscription or membership. Vendors responding to a SIG Lite sent by a customer do not need their own license to complete it.
How long does it take to complete a SIG Lite questionnaire?
A vendor with a mature answer library and current documentation can complete one in a day or two. A first-time responder assembling evidence from scratch should budget one to two weeks. SIG Core, by comparison, routinely takes several weeks of cross-functional effort.
Can small businesses use SIG Lite?
Yes, on both sides. Small assessors get an industry-recognized framework without building one, and small vendors benefit because a completed SIG Lite is far less burdensome to produce than a Core, while still satisfying many customers’ due diligence requirements.
How do automated TPRM platforms handle SIG Lite?
They embed licensed SIG content, automate distribution and reminders, collect responses, apply scoring rubrics, flag threshold breaches, and map answers to compliance frameworks. This removes most of the manual overhead and makes portfolio-wide SIG Lite assessment practical for lean teams.
Can SIG Lite be adapted to emerging compliance frameworks?
Yes. The annual update cycle folds new frameworks into the standard question set and mappings; the 2026 release added ISO 42001 for AI governance and deepened NIST SP 800-171 coverage. Assessors can also append up to 100 custom questions to address requirements the standard set does not yet cover.
Does SIG Lite replace a full security audit?
No. SIG Lite is a self-assessment questionnaire, not independent verification. It documents what a vendor claims about its controls; a SOC 2 report or ISO 27001 certification independently validates those claims. Mature programs use both the SIG for standardized information gathering and the audit report as supporting evidence.
