SIG Lite questionnaire: what it is and how to complete it without a security team

Banks, insurers and other larger companies often send vendors a SIG: a long, structured security questionnaire. If yours says “SIG Lite”, you have the shorter version. Here is what it is and how to get through it.

What the SIG is

SIG stands for Standardized Information Gathering questionnaire. It is published by Shared Assessments, an industry membership organization focused on third-party risk, and it is updated every year. Because it is licensed, you will normally receive the file from the customer rather than download it yourself.

The SIG covers a wide range of risk areas, from information security and privacy to business continuity and vendor management.

SIG Lite vs SIG Core

• SIG Lite is the shorter version, often used for vendors a company considers lower risk, or as a first pass before deciding whether to ask for more.
• SIG Core is much longer and more detailed, used for vendors that handle sensitive or regulated information.

The exact number of questions changes between yearly versions, so go by the file you received. If you got SIG Core and think SIG Lite fits your service better, it is reasonable to ask, but answer what they asked for.

How to complete it

1. Read the instructions tab and check which sections apply. Many questions only apply if you do certain things (for example, run your own data centres or process card payments).
2. Collect your sources first: security policy, access control and incident response documents, subprocessor list, and any audit reports or test summaries.
3. Answer the factual questions first (hosting, encryption, access, backups), then the harder governance and policy ones.
4. Use N/A properly: explain in one sentence why a question doesn’t apply.
5. Where you don’t meet a control, say so and describe what you do instead. Overclaims tend to surface during follow-up questions or audits.
6. Reference evidence. Name the document that backs each important answer.
7. Save your answers. The next SIG from another customer will repeat most of them.

Common pitfalls

• Answering for your cloud provider instead of your own company.
• Contradictions between sections that ask about the same control.
• Vague answers such as “industry-standard security” (see 10 answers that invite follow-up questions).
• Copying answers from an old SIG without checking they are still true.

Answering a SIG Lite with Rendro

Upload the SIG file as you received it. Rendro drafts each answer only from your own documents, shows the source, flags what your documents don’t cover instead of guessing, and writes the answers back into the original workbook. Approved answers go into your answer library for the next questionnaire.