The Standardized Information Gathering (SIG) questionnaire is a pillar of third-party risk management. But for all its power, it's a tool many teams use incorrectly, leading to wasted time and hidden risks. Here's where they go wrong.
First, What Is the SIG?
Before diving into
the mistakes, let's level-set. The SIG, developed by a consortium called Shared Assessments, is a comprehensive set of questions used to evaluate a vendor's security and risk controls. Instead of every company creating its own unique vendor questionnaire, the SIG provides a standardized framework that covers everything from data privacy to business resiliency. It comes in different flavors—like 'Lite' for low-risk vendors and 'Core' for more critical partners—allowing companies to right-size their due diligence. The goal is to create an efficient, consistent way to trust, but verify, the security posture of the partners you rely on. It's not just another form; it's the foundation of a modern vendor risk program.
Mistake 1: Treating It Like a Simple Checklist
The most common misstep is viewing the SIG as a box-checking exercise. Teams, under pressure, focus on getting every question answered just to mark the task as 'complete'. This turns a strategic risk assessment into a mindless administrative drill. The point of the SIG isn't just to get a 'yes' or 'no'. It's to understand the 'how' and 'why' behind a vendor's controls. A rushed, superficial approach often leads to accepting vague answers or failing to ask for crucial supporting evidence, like a SOC 2 report or specific policy documents. This defeats the entire purpose, creating a false sense of security while leaving actual risks unexamined.
Mistake 2: Using the Wrong Tool for the Job
Shared Assessments offers different versions of the SIG for a reason. The 'Core' version, with its hundreds of detailed questions, is designed for high-risk vendors that handle sensitive data. The 'Lite' version is for lower-risk engagements. A frequent error is applying a one-size-fits-all approach. Sending an 800-question SIG Core to a low-risk marketing vendor not only irritates the vendor but also buries your team in irrelevant data. Conversely, using a SIG Lite for a critical cloud infrastructure provider is negligent. Misreading the situation and failing to tailor the questionnaire to the specific vendor relationship wastes resources and leads to either insufficient diligence or unnecessary friction.
Mistake 3: Assigning It Without Context or Collaboration
A SIG questionnaire is not a task for a single person in procurement or IT to handle alone. Answering one accurately requires input from multiple departments, including security, legal, compliance, and operations. Likewise, when a company sends a SIG to a vendor, it often gets lobbed over the fence to a sales contact who may not have the technical knowledge to provide accurate answers. Effective use of the SIG requires assigning questions to the right subject matter experts and fostering open communication. Without this collaboration, answers are often guessed, incomplete, or outright wrong, rendering the assessment unreliable. The best practice is to treat it as a cross_functional project, not a siloed task.
Mistake 4: Focusing on the Answers, Not the Evidence
The phrase 'Trust, but verify' is central to the Shared Assessments philosophy. A completed SIG questionnaire is the 'trust' part. The 'verify' part is the evidence that backs up the answers. Many teams stop at the first step. They get the questionnaire back and file it away without ever asking for the proof. A vendor can claim to have robust incident response protocols, but that claim is meaningless without seeing the actual incident response plan or recent test results. The SIG is a map that points to areas of potential risk; it's not the destination itself. A strong process involves reviewing the SIG responses alongside objective evidence like thirdparty audit reports (like a SOC 2), policy documents, and system configurations.
