Standardized Information Gathering Questionnaire (SIG)
Outsourcers use the Standardized Information Gathering Questionnaire (the "SIG") to obtain required documentation on a service provider and establish a profile on operations and controls for each control area. Service providers may give their SIG directly to their clients (or prospective clients).
The SIG is organized in three sections:
- Information on the service provider and its service profile. This includes detailed information about the physical and technological environments for relevant operations.
- Documents required by client organizations. Service providers may choose to provide the document, a summary, the table of contents, or other information about the requested document. The outsourcer determines the document's acceptability based on its risk profile and the risk and complexity of the outsourced application, system or service.
- High-level industry expectation and series of questions for each control area. All questions require closed-ended responses with the option to provide additional information as necessary.
Service providers may share the SIG with current and prospective clients, providing information on relevant locations, systems or services.