Which statement best describes the SIG Lite?

The Standardized Information Gathering (SIG) Lite questionnaire is an industry-standard tool developed by the Shared Assessments Program. It is designed for assessing vendors that pose a lower level of risk or for conducting initial, high-level due diligence. The SIG Lite contains a reduced set of questions compared to the more comprehensive SIG Core, focusing on fundamental security controls to provide a broad but not deeply detailed understanding of a vendor's security posture. This makes it suitable for situations where a full, in-depth assessment is not required.

A. The SIG Lite is an industry-standard tool created by Shared Assessments for broad use, not a questionnaire specific to a single company.

B. ServiceNow integrates and provides the SIG Lite as part of its Vendor Risk Management application, but it is developed and maintained by the Shared Assessments organization.

D. The more comprehensive SIG Core questionnaire, not the SIG Lite, is designed for assessing vendors that handle highly sensitive or regulated information requiring a deep-level assessment.

1. ServiceNow Product Documentation: In the "Preconfigured content in Vendor Risk Management" section, the documentation describes the out-of-the-box questionnaires. It specifies that the "Shared Assessments SIG Lite 2022" is intended for "vendors that do not have access to sensitive information," confirming its use for lower-risk, high-level assessments. (ServiceNow Product Documentation, Vendor Risk Management, "Preconfigured content in Vendor Risk Management").

2. Shared Assessments Program: The official creator of the SIG defines the SIG Lite as a "streamlined version of the SIG Core" that can be used for "scoping third parties that do not require a deep-level of assessment." This aligns with its purpose for basic due diligence and lower-risk vendors. (Shared Assessments, "Standardized Information Gathering (SIG) Questionnaire Tools").