Introduction
You have just won a shortlist position with a major enterprise client or financial institution. Then the email arrives: a spreadsheet with hundreds of questions, every domain of your security program laid bare under the heading 'SIG Questionnaire.' Your stomach drops.
You are not alone. The Standardised Information Gathering (SIG) questionnaire is one of the most comprehensive vendor security assessments in existence — and also one of the most daunting. This guide tells you exactly what it is, what it is asking, and how to get through it without it becoming a three-week crisis.
What Is the SIG Questionnaire?
The SIG, developed and maintained by Shared Assessments, is an industry-standard framework for evaluating the cybersecurity, privacy, operational resilience, and compliance posture of third-party vendors and service providers. It is used by banks, insurers, healthcare organisations, and large enterprises to assess the risks introduced by their supply chain.
The SIG comes in several versions:
• SIG Core: The full version with over 1,200 detailed questions across 19+ risk domains. Used for high-risk, critical vendors.
• SIG Lite: A condensed version of approximately 150–200 questions. Used for lower-risk vendors or initial screening.
• Custom-scoped SIG: Organisations can scope the questionnaire to include only the domains relevant to the vendor relationship.
The SIG maps to over 35 regulatory frameworks, including ISO 27001, NIST SP 800-53, GDPR, PCI DSS, HIPAA, and the Cloud Security Alliance's Cloud Controls Matrix. If you have existing documentation aligned to any of these frameworks, it will significantly accelerate your SIG completion.
The 19 Risk Domains — What Is Actually Being Assessed?
The SIG covers the following domains, each with a set of questions probing the design and operational effectiveness of your controls:
1. Access Control — who can access what, and how is it managed
2. Application Security — how you develop and secure software
3. Audit Management — logging, monitoring, and audit trails
4. Business Continuity — your ability to recover from disruptions
5. Cloud Hosting — controls for cloud environments
6. Compliance — how you manage regulatory obligations
7. Cyber Incident Management — your incident response capability
8. Data Management — data classification, handling, and retention
9. Encryption and Key Management — how sensitive data is protected in transit and at rest
10. Environmental Controls — physical security of facilities
11. HR Security — personnel security controls
12. Information Risk Management — your risk assessment and treatment processes
13. Network Security — controls protecting your network perimeter
14. Nth-Party Management — how you manage your own vendors' vendors
15. Physical Security — controlling physical access to your environment
16. Privacy — personal data handling and privacy rights
17. Resilience — disaster recovery and system redundancy
18. Threat and Vulnerability Management — how you identify and remediate vulnerabilities
A Practical Strategy for Completing the SIG
Step 1: Assemble Your Evidence Library First
Before you open the questionnaire, gather the documentation you will reference: security policies, penetration test reports, ISO 27001 or SOC 2 certificates, incident response plans, BCPs, vulnerability scan reports, and vendor management procedures. Trying to answer questions without evidence behind you leads to inconsistent, vague responses that undermine your credibility.
Step 2: Assign Domain Owners
The SIG is not a one-person job. Map each domain to the person in your organisation best placed to answer it — IT for network and access controls, HR for personnel security, legal or compliance for data protection. Create a shared document with clear ownership and deadlines.
Step 3: Answer Consistently and Evidentially
Assessors reviewing SIG responses are looking for consistency across domains and the ability to substantiate claims with evidence. If you state you have an MFA policy in the Access Control domain, the same MFA control should appear consistently in other relevant domains. Inconsistency raises red flags.
Step 4: Do Not Fake It
If a control does not exist, say so and describe your compensating control or remediation plan. Assessors are trained to identify implausible responses. Honesty with a credible improvement plan is far better than inflated claims that fall apart under follow-up questioning.
Step 5: Reuse Your Responses
Once you have completed a SIG, that response library becomes a reusable asset. Store your responses in a structured format so you can adapt them for future SIG requests, CAIQ submissions, or custom questionnaires with minimal rework.
When to Bring in a Specialist
If the SIG arrives in the context of a high-value enterprise contract, you should consider engaging a security advisor to review your responses before submission. A poorly completed SIG — even if your actual security posture is strong — can cost you a deal. An experienced practitioner can review your responses for consistency, completeness, and credibility in a single engagement. CyberEagle's Security Questionnaire Completion service starts from AUD 350 per questionnaire — significantly below the AUD 1,500–5,000+ that specialist compliance consultancies typically charge for the same deliverable.
The Bottom Line
The SIG questionnaire is not designed to trip you up. It is designed to give enterprise customers confidence that their vendors will not become a liability. If your security program is in reasonable shape, the SIG is an opportunity to demonstrate that — and turn compliance into a competitive advantage.