What the SIG covers
The SIG is built to give an organization a full picture of the risks a vendor could bring into its business. Rather than looking only at technical security, it asks how the vendor is governed, how it handles data and how it would keep delivering its services if something went wrong. Shared Assessments maintains the questionnaire, updates it regularly and maps its content to widely used security and privacy frameworks, standards and regulations.
Its questions are grouped into risk domains. The list changes as the SIG is updated, but the domains broadly cover areas like these:
- Governance: enterprise risk management, security policies and how security is organized and overseen
- Information security: access control, network, server and endpoint security, application security and cloud hosting
- Asset and data management: how information and assets are classified, handled, retained and disposed of
- Privacy: how personal information is collected, used, shared and protected
- Business resilience: business continuity, disaster recovery and how services keep running through a disruption
- Incident and threat management: detecting, responding to and reporting security incidents, and managing vulnerabilities and threats
- People and premises: human resources security, such as screening and training, and physical and environmental security
- Third-party and supply chain risk: how the vendor oversees its own suppliers and subcontractors
- Compliance: the laws, regulations and contract terms that apply and how the vendor meets them
SIG Lite vs SIG Core
The SIG comes in more than one size, so the organization sending it can match the depth of the review to the risk of the relationship. The two versions you are most likely to meet are SIG Lite and SIG Core.
SIG Lite is the shorter version. It asks higher-level questions across the same broad risk areas, which makes it a good fit for lower-risk relationships, such as vendors with limited access to sensitive systems or data, and for initial screening before a deeper review. Many organizations send SIG Lite first and use the answers to decide whether a vendor needs a closer look.
SIG Core is the comprehensive version. It goes into much more detail within each domain and is meant for higher-risk vendors, such as those that store or process sensitive data, connect to critical systems or provide services the business depends on. It takes longer to complete and usually draws in several teams.
Senders can also tailor the SIG by choosing only the domains and questions that fit a particular vendor, so what you receive may be a custom selection rather than the full SIG Lite or SIG Core.
Who sends and answers a SIG
A SIG is usually sent by the team responsible for third-party risk at the buying organization. Depending on how the company is set up, that may be vendor risk management, procurement, information security, privacy or compliance. It is especially common in financial services and other regulated industries, but companies in many sectors use it because a standard questionnaire is easier to send and compare than a homemade one.
On the receiving side, the SIG lands with whoever owns customer security reviews. At a software or services company, that is often the security or compliance team, sales engineering or a proposal team, with help from IT, legal, privacy, human resources and facilities. Some vendors complete a SIG in advance and share it on request, which can spare both sides a repeat review.
How to answer a SIG well
A SIG can be long, and the requester relies on your answers when deciding whether to work with you. Reviewers often check responses against your policies and reports and follow up on anything vague or inconsistent. A few habits help:
- Confirm the scope: check whether you received SIG Lite, SIG Core or a custom selection, which products, services and locations the answers should cover, and when the response is due.
- Start from approved answers: keep a library of reviewed responses to common SIG questions and adjust each to the question in front of you.
- Give the direct answer first: many SIG questions expect a yes, no or not applicable response, so lead with it and add a short, specific explanation where it helps.
- Back answers with evidence: keep current copies of the policies, audit reports, certifications and test results you may need to provide, and make sure they match what your answers say.
- Be honest about gaps: if a control is not in place, say so and describe any compensating measures or plans, rather than leaving the answer blank or overstating what you do.
- Share the work: route each domain to the person who owns it, such as IT for network questions or human resources for screening and training, and have one reviewer read the full response.
- Stay consistent: make sure your answers agree with each other, with your security documentation and with anything you have already told the same customer.
How the SIG relates to other security questionnaires and DDQs
The SIG is one of several standard security questionnaires. Others include the Consensus Assessments Initiative Questionnaire (CAIQ) from the Cloud Security Alliance, aimed at cloud services, and questionnaires built for particular industries. Many companies also write their own vendor security questionnaires, some of them based on the SIG. Whatever the name, they cover much the same ground, so answers prepared for one give you a head start on the next.
A due diligence questionnaire, or DDQ, is a broader term for any structured set of questions used to vet a firm or vendor. A vendor DDQ may cover financial stability, ownership, legal matters and operations as well as security, while the SIG concentrates on risk, security, privacy and resilience. A buyer might send a SIG as the security part of a wider review, or a DDQ that borrows questions from the SIG.
RFIs and RFPs serve a different purpose: they help a buyer learn what vendors offer and compare proposals and prices. A security questionnaire such as the SIG often arrives alongside an RFP or once a shortlist is set.
How XiCLOPS helps you answer a SIG
XiCLOPS uses your own documents to fill out RFPs, RFIs and due diligence questionnaires, including security and vendor questionnaires like the SIG. It works with Word, Excel, PowerPoint and PDF files.
For each answer, you can see the source documents behind it, so you can check the response against your evidence before the SIG goes back. Where your files do not cover a detail, a yellow highlight flags it, so you know where to add information or describe a gap.
Your questionnaire comes back in its original format. You can try one run free, with no card required.