Regulatory Standards · Global
SIG Questionnaire
Answer SIG questionnaires from evidence, not memory.
The Shared Assessments SIG is the standard questionnaire for third-party risk. Astragar maintains the control evidence behind every answer, so responses are faster and defensible.
Book a SIG review✓ Available in Astragar GRC
SIG Core
Full assessment for critical providers
SIG Lite
Shorter assessment for lower-risk providers
Annual
Content updated each year by Shared Assessments
What SIG requires
The obligations, in brief.
Scoped responses
Answer the domains relevant to the services you provide.
Supporting evidence
Back answers with policies, reports and technical proof.
Consistency
Give every customer the same accurate answer.
Follow-ups
Resolve findings and remediation requests from assessors.
How Astragar helps
From checklist to measurable risk.
01
Requirement → control mapping
Map every SIG requirement to controls, systems, assets and owners.
02
Evidence, continuously
Collect and maintain evidence, with sign-off from contributor to IT auditor, CISO and executive office.
03
Exposure behind the gaps
See which vulnerabilities and sensitive data put SIG controls at risk.
04
Risk in financial terms
Prioritise remediation by business and financial impact, not checklist order.
One evidence base answers SIG, SOC 2 and ISO 27001 questions without re-collecting.
Sign-off workflow
Evidence Contributor
→IT Auditor
→CISO
→Executive Office
Find the data. Test the controls. Reduce the risk.
Start with a scoped SIG review: requirements mapped, evidence gaps found, remediation prioritised by financial impact.
Book a SIG reviewAstragar supports compliance programmes with technical evidence and risk analysis. It does not provide legal advice or issue certifications.
See your cyber risk in $ terms, not CVSS scores.
