Sign in

Shared Assessments SIG

Shared Assessments Standardized Information Gathering Questionnaire — Shared Assessments

Also known as: SIG, Shared Assessments SIG, Standardized Information Gathering, SIG Lite, SIG Core, SIG 2025, SIG 2026, 2026 SIG

Official site Official change log Subscribe to Shared Assessments SIG (RSS)

This is a paid standard. We publish the fact of a change, its version and date, and a link to the publisher — the text itself is not reproduced.

Current version
2026 SIG
source
Status
In force
Next deadline
None announced
Who must comply
Organizations assessing the risk controls of their vendors and service providers, and the vendors that answer the questionnaire. source
How it is assessed
Vendors answer SIG questionnaires scoped by the requesting organization; the content is released on an annual cycle. source
Written by
Published by Shared Assessments as a licensed product, included with membership or sold as a standalone subscription. source
Enforced by
Use of the SIG is governed by its licence, sold with membership or as a subscription. source
Last change
None recorded yet

The questionnaire most third-party risk programmes send their vendors. Its answer set is what buyers compare against.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates
  1. Shared Assessments announces SIG EV, a cloud-based version of the SIG, for early 2026

Version history

  1. —
    2026 SIG RevisionCurrent

    Yearly content update adding references to ISO/IEC 42001 and the BRC Operational Resilience Framework, more detailed NIST SP 800-171 mapping and alignment with ISO 27001:2022 Annex A. source

    More
    • New scoping presets (Lite, Core and Detail) for the Standardized Control Assessment.

Who it applies to

The questionnaire third-party risk teams send to vendors, covering 21 risk domains and mapped to current regulations and standards.

Use
Used to evaluate the risk controls of an organization's vendors and service providers; some organizations also use it to evaluate their own controls for prospective customers. source
Risk domains
Measures security risks across 21 risk control areas, from access control and AI to privacy management and supply chain risk management. source
Mappings
Mapped to standards and laws such as ISO 27001:2022, NIST SP 800-53, NIST CSF 2.0, DORA, NIS 2, GDPR, HIPAA, NYDFS 23 NYCRR 500 and PCI DSS 4.0. source
Lite and Core
The SIG Manager provides two pre-configured questionnaires, SIG Lite and SIG Core, and builds custom ones by regulation or risk domain. source

How compliance is assessed

Vendors answer SIG questionnaires scoped by the requesting organization; the content is released on an annual cycle.

Questionnaire
A SIG Questionnaire is generated by the SIG Manager from a standard or custom scoping template and sent to vendors. source
Annual release
SIG content continues to follow the established annual release cycle. source
SIG EV
SIG EV is the web-based delivery of the SIG; it keeps the SIG's content, structure and methodology and is not a TPRM or GRC platform. source

Enforcement and penalties

Use of the SIG is governed by its licence, sold with membership or as a subscription.

Licence
The SIG is available as a standalone product subscription and is included with all levels of membership; the corporate licence is listed at $7,000 a year. source
Licensed use
Access to the SIG Manager is licensed to product subscribers and members. source

Documents

  1. Guidance SIG — product page
  2. FAQ Your Top Questions About the SIG Answered (FAQ)
  3. Guidance Coming Soon: 2026 SIG Workbook: Key Updates and Enhancements
  4. Guidance Coming Soon: Product Release 2027

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Shared Assessments SIG (RSS)