SIG (Shared Assessments) U1: Scope each SIG to the third party's inherent risk: SIG Lite, SIG Core or a custom SIG

The outsourcer selects the questionnaire from the SIG Manager content library according to the inherent risk of the product or service being assessed. The preconfigured SIG Lite is the program-level assessment for lower-risk third parties, and is also used for requests for offer or information, merger and acquisition diligence and pre-assessments, or as a first pass before a deeper review. The preconfigured SIG Core gives a deeper, more tailored assessment for medium to high risk third parties, adding questions at the control definition level, and is typically used where the third party stores or manages highly sensitive or regulated data or delivers services critical to the business. Where neither fits, a custom SIG is built by selecting risk domains, mapping references (standards or regulations) or control families and the scope level of each (Lite, Core or Detail); questions not selected are excluded once the custom template is saved, and further questions can be added from the content library. The 2026 workbook formalises these as built-in Lite, Core and Detail scoping presets.