Send SIG Lite to vendors that need less due diligence or are not critical, and SIG Core to vendors that handle sensitive data or support important functions. Lite is a screen. Core is a full review. Whichever you pick, scope it to the service rather than sending the whole file.
What the SIG is
The SIG (Standardized Information Gathering) questionnaire is published by Shared Assessments and used by many companies to assess third parties. I could not load the Shared Assessments site directly, so the counts below come from a licensee's summary of the 2025 version. Check the actual file you receive, because counts and scope can differ.
The versions
A Mitratech write-up of SIG 2025 reports:
- SIG Lite has 128 questions and typically serves vendors that need less due diligence or are not as critical.
- SIG Core has 627 questions across 21 risk categories.
- A fuller version, SIG Detail, is reported at 1,936 questions.
Question counts for these files have varied between sources and years, so treat them as approximate and confirm with the file in hand.
What changed in 2025
The same source says no new risk domains were added, but some domains gained questions: information assurance, cybersecurity incident management (including outsourced incident reporting), and operational resilience. It also reports new mappings to EU DORA, EU NIS2 and NIST CSF 2.0.
If you sell into regulated European customers, those mappings may explain why your buyers have started asking about resilience and incident reporting.
Choosing between them
Ask these in order:
- Does the vendor hold regulated or highly sensitive data for you? If yes, lean to Core.
- Would a vendor outage stop a critical process? If yes, lean to Core.
- Is the vendor replaceable in a week with no data exposure? Lite is likely enough.
- Do you already hold an independent audit report that covers the same ground? Then Lite plus the report may do.
Scope it, do not dump it
A 627 question file sent to a small vendor produces rushed, copied answers. Pick the sections that match your risk. If the service never touches personal data, the privacy sections can wait. A shorter set answered carefully is worth more than a long set answered by whoever had time on Friday.
Reviewing the answers
Sort answers into three piles: fine, unclear, and needs evidence. Ask for evidence on the second and third. Keep a record of what you asked and what came back. The same habit helps when you review red flags in questionnaire answers.
Quick check
Is SIG Lite good enough for a critical vendor?
Usually not on its own. Use it as a screen, then move to Core or an independent audit report.
Do I have to send every section of SIG Core?
No. Scope the sections to the service and the data involved, and say why you left sections out.
Sources
Last reviewed: 19 October 2026.
