Framework

SIG (Shared Assessments): what it anchors in a questionnaire

The Shared Assessments questionnaire banks and insurers send. Its ids name a domain letter (A to U); a SIG reference in a question places its domain.

The text of this standard is not held in full here, so it is not quoted: each requirement carries a one-line statement of what it asks for, with its code and title, and the standard itself holds the wording. Ticked by default for bank and other customer customers.

Families anchored here

24 families, 12 clauses cited

Family	Clause
Information security policy	domain B
Risk assessment	domain A
Background checks	domain E
Security awareness training	domain E
Confidentiality terms and leavers	domain E
Multi-factor authentication	domain H
Password policy	domain H
Access provisioning and review	domain H
Privileged access	domain H
Encryption at rest	domain D
Data retention and secure deletion	domain D
Logging and monitoring	domain G
Vulnerability and patch management	domain P
Penetration testing	domain P
Secure development and change	domain I
Incident response plan	domain J
Notifying the customer of an incident	domain J
Business continuity plan	domain K
Backup and disaster recovery	domain K
Subcontractors and subprocessors	domain T
Assessing your own suppliers	domain T
Data subject requests	domain O
Lawful basis, consent and privacy notice	domain O
Data processing agreement	domain O

Every SIG clause the register cites, with its text and evidence