In a March 2026 write-up of the SIG 2026 release, Mitratech noted that the Standardized Information Gathering (SIG) questionnaire from Shared Assessments now formalizes Lite, Core and Detail presets, so a buyer can match questionnaire depth to a vendor's risk without editing the file by hand. No new risk domains were added, but new resilience questions ask vendors to show awareness of their own critical downstream dependencies.
For a small software company this means two things. You will see SIG files of different sizes from different buyers, and you will be asked who your own vendors are. Both are easier if you stop answering questionnaires one at a time.
What's affected
Anyone selling to banks, insurers, healthcare or large enterprises. Their procurement teams use three kinds of files:
| Type | Who sends it | What to expect |
|---|---|---|
| SIG (Lite, Core, Detail) | Buyers who use the Shared Assessments SIG | Depth set by the preset the buyer chose, so two "Core" files may differ |
| CAIQ | Buyers who prefer the CSA cloud control set | Maps to CCM control IDs |
| Custom spreadsheet | Everyone else | Same topics, different wording, often a few strange questions |
The topics barely change between them: governance, access, change management, vulnerability handling, incident response, business continuity, vendor management, privacy. Only the phrasing and the format differ.
What to do now
- Create one answer bank, a spreadsheet with a row per topic. Columns: topic, short answer, long answer, evidence file, owner, last reviewed.
- For the resilience question buyers now ask, list your critical vendors (cloud host, identity provider, email, payments, source control) and what happens to your service if each is down for a day.
- When a new file arrives, copy answers from the bank. Only write fresh text for questions the bank does not cover, then add that answer to the bank.
- Answer in the buyer's format. Never send your bank in place of their file unless they agree in writing.
- Mark unsupported controls honestly: "Not implemented, planned for Q1" is accepted far more often than a Yes that fails at the follow-up call.
A note on odd questions
Custom spreadsheets always contain a few questions that fit no framework, such as "do you have a clean desk policy?" Add them to the bank under an "other" topic with the answer you gave, and ask the buyer whether the question is a hard requirement. Many are leftovers from older templates, and a short conversation can remove them from the next round.
How to avoid this trap
- Do not let sales answer questionnaires from memory. Route every file through the bank owner.
- Do not paste answers from a licensed questionnaire into outside tools without checking the license terms of the file you received.
- Review the bank when anything material changes: a new cloud region, a new identity provider, a new subprocessor.
- Keep a changelog. If a buyer asks why an answer changed since last year, you need the reason.
Try it yourself
Take the last questionnaire you answered and split its questions by topic. If more than half of the questions map to rows you already have, your bank will pay off on the next file.
Click through it at your own pace, or open it full screen.
Quick check
Why can two buyers' SIG Core files differ?
Buyers can scope the questionnaire by domain or preset, so the question set depends on how the buyer configured it.
What should you do with a control you have not implemented?
Say so plainly and add a short plan or timeline note. Do not answer Yes.
