Files

Thank you for registering to download Version 5 of the Standardized Information Gathering (SIG) Questionnaire and the Agreed Upon Procedures (AUP).

In addition to the full SIG and AUP, several standalone portions of the SIG are available for organizations whose evaluations do not require the full SIG Questionnaire.  All SIG downloads include the SIG Management Tool to help users get maximum value from all of the SIG documents.

For more information about using the SIG and AUP, including FAQs and spreadsheets that map the Shared Assessments tools to PCI, ISO, HIPAA and other standards, please visit our Resources page.

To download, click on the appropriate link below.

Agreed Upon Procedures (AUP v. 5.0)

PDF document

Assessment firms use the AUP to perform objective and consistent service provider evaluations.  Service providers use AUP reports to provide consistent information to a range of clients and reduce or eliminate the need for on-site audits.  Service providers may also use the AUP to perform self-assessments on their procedural controls for security, privacy and business continuity.

Standardized Information Gathering Questionnaire (SIG v. 5.0)

Zipped file: The full SIG and the SIG Management Tool

Outsourcers use the SIG as a default questionnaire to streamline vendor assessments.  For vendors, the SIG provides a repeatable response to proprietary questionnaires from clients.

Level I Questions Only

Zipped file: SIG Level I Questions and Information Tabs and the SIG Management Tool

Use the SIG Level I Questions for new service providers and other appropriate relationships (typically low to moderate risk) as indicated by your risk model.

Level II Questions Only

Zipped file: SIG Level II Questions and Information Tabs and the SIG Management Tool

Use the SIG Level II Questions for appropriate service provider relationships according to your risk model (typically medium to high risk).

Business Continuity Questions Only

Zipped file: SIG Business Continuity Tab (Tab "K") and Information Tabs and the SIG Management Tool

Use the SIG Business Continuity Questions to assess the adequacy of a vendor's recovery capabilities.

Privacy Questions Only

Zipped file: SIG Privacy Tab (Tab "P") and Information Tabs and the SIG Management Tool

Use the SIG Privacy questionnaire for service providers where you need to understand the service provider's adherence to certain privacy frameworks and controls.  Note: this privacy questionnaire does not cover Information Security.  This information if needed should be obtained from the full SIG.

Standardized Information Gathering (SIG) Questionnaire (XML SIG v.5.0)

For developers and administrators of applications that support an XML version of SIG 5.0, this version of the SIG facilitates automation and concurrency among question responders.  Outsourcers may use the XML SIG to import service provider responses directly into their global risk and compliance systems. 

Target Data Tracker

This document contains three critical questions that clients should ask their service providers prior to evaluating their controls for information security, business continuity, and privacy