Free template · CSV · Excel · Google Sheets
A free SIG Lite answer-library template.
Most "free security questionnaire templates" are a PDF you can't type into. This one ships in three formats and the answers are already worked as examples — open it, see what a defensible answer looks like, then overwrite each row with your organisation's verified responses.
Built for vendors who keep getting SIG Lite, CAIQ, and SOC 2 evidence requests — across finance, telecom, healthcare, and SaaS. You're not the first vendor on this page; you don't have to be the last.
Every file opens with a disclaimer banner: the answers are sample only, written to show shape — replace them with your real, cited responses before sending anything to a customer.
Prefer a formatted view? There's a print-ready branded version (HTML) of the same template. Prefer GitHub? It lives at jasonezard/sig-lite-answer-library — including an expanded guide to the three answer patterns (and the anti-patterns that fail reviews). Contributions welcome.
What's in it
- 33 starter questions across 14 SIG-style risk domains — access control, incident response, application security, business resilience, cloud hosting, privacy, third-party management, and more. Every row carries an ISO 27001:2022 / NIST CSF / CSA CCM cross-reference in the new
Framework mappingcolumn. The wording is ours; swap in your customer's exact questions as they arrive. - A worked sample answer in every row, plus three labelled worked examples at the top showing the three shapes a defensible answer takes: a clean "yes" with citations, a tested-control answer, and an honest gap answered with a compensating control and a roadmap.
- The columns that make answers reusable: evidence/citation, owner, status, and last-verified date. The citation column is the whole trick — "Yes" expires; "Yes, per Access Control Policy §4, reviewed May 2026" survives into the next questionnaire.
- A disclaimer at the top of every file reminding whoever opens it that the answers are samples for shape only — overwrite before sending to a customer.
What it is not
SIG and SIG Lite are products of Shared Assessments, and the official question set is licensed — we don't reproduce it, and you should be skeptical of any free download that claims to. You'll receive the real SIG from your customer. What this template gives you is the answer side, organized around comparable domains, so that when the official spreadsheet lands, most of your answers are already written and cited.
How to use it
- Fill in what's true today. Work down the rows answering only to controls that actually run. Aspirations go in the notes, not the answer cell.
- Cite as you go. Every answer names the policy, tool, or dated report behind it. Uncited answers are the first ones to rot.
- Tag the gaps honestly. Empty rows are your gap list — the same list a reviewer would find anyway. Pair each gap with the compensating control you run today (see worked example EX-3).
- Assign owners and verify dates. An answer nobody owns is an answer that's wrong by next quarter. Re-verify before each submission.
- When the real questionnaire arrives, map its questions to your library rows, copy, adapt wording, done. Teams that maintain the library reuse most of it per questionnaire.
If the deadline is this week
A template helps you build the library over weeks. It does not help when the SIG arrived Tuesday and procurement wants it back Friday. For that, Questionnaire Rescue exists: we read the questionnaire and your actual posture in parallel, draft truthful answers citing your real controls, and hand back both the completed document and the library — $399 flat covers the scoping session, the completed document, the gap list, and the library, checkout online, priced to fit on a company card without an approval cycle.
Common questions.
Is this the official SIG Lite questionnaire?
No. SIG and SIG Lite are products of Shared Assessments, and the official question set is licensed — you'll receive the real document from your customer or from Shared Assessments directly. This is a free answer-library template organized around comparable risk domains, so your answers are ready before the official spreadsheet arrives.
Why build an answer library instead of just filling in the questionnaire?
Because every prospect's questionnaire is mostly the same questions in a different spreadsheet. If your answers live in one cited, dated library, the next SIG, CAIQ, or insurance form starts mostly answered. If they only live in last quarter's submitted spreadsheet, you start from scratch every time.
Do I need to give you my email to download it?
No. The CSV, Excel, and Google Sheets versions download instantly with no email — that's deliberate. Why? Because asking for an email for a free template is a bait. If you want us to remember you for a follow-up (e.g. when we publish the SIG Core extension or the CAIQ-Lite worked answers), there's an opt-in box on the SIG-Lite library landing page at /downloads/sig-lite-answer-library/. Otherwise the file is yours, no strings.
Are the answers in the file real?
No — every row is a sample answer for illustration only. They are written the way a defensible answer should read (cited, dated, owned), but they describe a fictional company. Replace them with your organisation's verified responses before submitting to any customer or auditor; there is a disclaimer at the top of every file saying the same thing.
What if I can't answer most of the rows?
That's a finding, not a failure — the empty rows are your gap list. Answer what's true today, tag the gaps, and either work the roadmap or hand the whole thing to us: we draft truthful, cited answers in about 3 days for a fixed price quoted up front.