[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Introducing UpGuard's New SIG Lite Questionnaire](/blog/sig-lite-launch) Publish date June 29, 2025 {x} minute read # Introducing UpGuard's New SIG Lite Questionnaire [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Caitlin Postal](/team/caitlin-postal) Technical Writer Reviewed by Table of contents Free resource ### [Download now](#) Whether you're expanding use cases, adding new vendors, or scaling the scope of your offerings, you need to keep apprised of potential security risks impacting your organization. UpGuard has added the SIG Lite questionnaire to our Questionnaire Library, making SIG available to help UpGuard customers evaluate third-party risks and potential vulnerabilities in your vendors' security policies. The Standardized Information Gathering (SIG) Questionnaire is designed to help you standardize your third-party vendor risk management program (TPRM) across a range of IT security and risk management topics. SIG's risk domains are now available with our introduction of the SIG Lite Questionnaire in the UpGuard platform. ## Understanding SIG and Shared Assessments The Standardized Information Gathering questionnaire, developed by [Shared Assessments](https://sharedassessments.org/sig/), provides a comprehensive set of questions for assessing third-party risks and managing your vendor assessments. Shared Assessments updates the SIG annually to ensure that it reflects changes in the cybersecurity landscape, and more than 100,000 SIG questionnaires are exchanged among service providers each year. The SIG framework includes two questionnaire approaches: SIG Lite and SIG Core. SIG Lite includes 126 questions for a high-level security overview, while the SIG Core questionnaire contains 855 risk control questions. SIG's 19 risk domains cover the following security areas: * Enterprise Risk Management * Nth-Party Management * Information Assurance * Asset and Information Management * Human Resources Security * Physical and Environmental Security * IT Operations Management * Access Control * Application Security * Cybersecurity Incident Management * Operational Resilience * Compliance Management * Endpoint Security * Network Security * Environmental, Social, and Governance (ESG) * Privacy Management * Threat Management * Server Security * Cloud Hosting Services As an organization, Shared Assessments considers industry standards and best practices for third-party risk management. The SIG aligns to a variety of regulatory frameworks and compliance guidelines, including [ISO 27001](https://www.upguard.com/blog/what-is-iso-27001) [NIST Cybersecurity Framework (CSF)](https://www.upguard.com/blog/nist-cybersecurity-framework), [General Data Protection Regulation (GDPR)](https://www.upguard.com/blog/compliance-guide-tprm-and-the-gdpr), [HIPAA](https://www.upguard.com/blog/hipaa-privacy-rule), [PCI DSS](https://www.upguard.com/blog/pci-compliance), [SOC 2](https://www.upguard.com/blog/soc-2-third-party-requirements), and [CIS](https://www.upguard.com/blog/cis-controls). This alignment ensures that your supply chain lifecycle meets your cybersecurity and data security needs. You can also use the SIG Lite questionnaire as part of your annual self-assessment. *Learn more about the SIG Questionnaire in our blog on *[*What is the SIG Questionnaire? TPRM Simplified*](https://www.upguard.com/blog/sig-questionnaire)*.* ## UpGuard's SIG Lite Questionnaire Launch Combine the SIG Lite questionnaire with UpGuard’s security ratings and risk assessment workflow to make informed decisions about your vendors, strengthen your business relationships, and streamline your third-party risk management processes. Replace your manual Excel spreadsheet questionnaire process with UpGuard's all-in-one automated security questionnaire. With SIG Lite available, UpGuard customers experience tangible benefits to third-party risk assessments: * Decrease time required to complete vendor security assessments in your vendor onboarding lifecycle. * [Eliminate manual questionnaire](https://www.upguard.com/product/trust-exchange/questionnaire-ai) and assessment processes through automation. * Improve vendor alignment to security and compliance standards. * Simplify remediation workflows for identified risks. With the SIG Lite questionnaire, you can streamline data collection and vendor risk assessments, reduce errors, and bring efficiency to your due diligence security assessments. Planning is underway for the development of a SIG Core questionnaire with a release expected in the near future. ### Access UpGuard's Questionnaire Library UpGuard's [Questionnaire Library](https://www.upguard.com/product/security-questionnaires) provides pre-built questionnaires that align to commonly used regulations and best practices in the cybersecurity industry. We are delighted to share that the SIG Lite questionnaire is now included in our library of 25+ standard assessment questionnaires. ### Simplify Vendor Data Collection The SIG questionnaire provides your organization a structured method to collect information about vendors' information security controls and risk posture. Within the UpGuard platform, you can view the current status of the questionnaire as your vendor completes it. UpGuard's all-in-one platform reduces complexity and decreases the time involved in vendor assessment by streamlining lengthy processes. Rather than using multiple systems to collect and analyze responses, you can save time and automate the process with UpGuard's SIG Lite questionnaire. ### Evaluate Your Vendors' Security Measures Once completed by a third-party vendor, review their answers and consider what any follow-up actions need to be taken to ensure your vendors meet your organization's security policies. Gain a holistic model of a vendor's security posture with UpGuard's risk mappings and security risk ratings, and generate reports to share with stakeholders using UpGuard's report templates. You can also prompt risk resolution by facilitating vendor remediation directly within the UpGuard platform. *Learn more about how to *[*manage your vendor remediation process with UpGuard*](https://help.upguard.com/en/articles/3992587-how-to-manage-vendor-remediation-requests-with-upguard)*.* Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Third-Party Risk Management #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 26, 2026 Third-Party Risk Management #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) October 29, 2026 Third-Party Risk Management #### [The Vendor Assurance Confidence Gap: Why It’s Widest With Your Most Critical Vendors](/blog/vendor-assurance-confidence-gap) Vendor assurance efforts are rising while confidence in them is falling. This gap is widest with the vendors that matter most. Here’s why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 25, 2026 Third-Party Risk Management #### [Higher Education TPRM in 2026: New Research Maps the Vendor Visibility Gap](/blog/higher-education-tprm-2026) Explore UpGuard’s latest research into higher education third-party risk, including supplier concentration and systemic vendor exposure. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 10, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)