The SIG, short for "Standardized Information Gathering (Questionnaire)" is a repository of third-party information security and privacy questions, indexed to multiple regulations and control frameworks. SIG is published by a non-profit called Shared Assessments, and has been in existence for about 10 years.
Shared Assessments updates the SIG questionnaire every year, reflecting new security and privacy challenges, changes to regulations and the latest trends and newest best practices in third-party risk management. Updates to the SIG usually have new questions, rewordings to old questions, deleted questions and reordering of the question sequence.
SIG users will "scope" their own questionnaire from the 1,200 question repository. Many licensees will use one of the two standard "scopings," SIG Lite (~330 questions) and SIG Core (~850 questions). Others may add more questions from the repository or even their own business- or industry-specific questions.
What is Shared Assessments?
Shared Assessments is a non-profit member-driven organization. The members determine how Shared Assessments will evolve the SIG each year, by voicing their opinions in committee meetings. These meetings are generally held each month, and the discussions drive how the Shared Assessments team will update the SIG content.
Who has adopted SIG?
The SIG is becoming increasingly common in the US across a number of industries, including many large US banks. Increasingly, large US vendors are adopting SIG. They in turn are requesting that customers and prospects accept their SIG in place of proprietary evaluator questionnaires.
Why is SIG useful for an evaluating company?
SIG reflects the combined knowledge and experience of hundreds of member organizations over more than ten years.
Because SIG is indexed to many standards (ISO 27002:2013, FFIEC Appendix J, FFIEC CAT, PCI, FFIEC IT Management Handbook, NIS SP 800-53 Rev 4, NIST CSF, HIPAA and GDPR), it makes compliance simpler. Choose a given control from any one of these, and you will find the SIG questions that address it.
How can a Panorays customer take advantage of a SIG questionnaire?
Typically, scoping the SIG security questionnaire results in generation of an Excel spreadsheet, which becomes a supplier questionnaire. With Panorays, however, this part of the process is completely automated.
Users of the Panorays platform benefit from:
- Rapid supplier vetting. Our typical customer is able to vet a vendor within eight days.
- Eliminating manual questionnaires
- Adding business context to the SIG questionnaire, so that suppliers receive only the questions that are relevant to their particular business relationship
Interested in automating your third-party security evaluation using SIG? Contact Panorays today.