SIG 2024: Key Updates and Considerations

New and Updated Content Mappings for SIG 2024

Along with adding the two net-new risk domains, the latest update to the SIG questionnaire added new content related to distinct compliance standards.

Artificial Intelligence: NIST AI RMF

With the addition of the new artificial intelligence risk domain, Shared Assessments also added the National Institute of Standards and Technology (NIST) Artificial Intelligence Risk Management Framework (NIST AI 100-1) to its compliance standards.

NIST introduced the AI RMF in January 2023 in recognition of the growing enterprise usage of AI tools and the lack of guidance on how to manage the risks. Check out our post where we took a deep dive into the AI RMF to understand its implications on third-party risk management. Shared Assessments adding the framework to the SIG questionnaire is a solid acceptance of the value of the guidance overall.

Cybersecurity Supply Chain Risk Management: NIST 800-161 r1

The addition of supply chain risk management to its list of risk domains also led to adding NIST SP 800-161r1, an updated guidance for cybersecurity risk management related to the supply chain. The NIST guidance itself was released in May 2022 and outlines best practices for Cybersecurity Supply Chain Risk Management (C-SCRM). The supply chain component of the SIG questionnaire emphasizes cybersecurity, so the addition of NIST 800-161 r1 is indicative of this focus.

Environmental, Social and Governance

In terms of environmental, social, and governance (ESG) compliance mandates, Shared Assessments added two new regulations:

• The German Supply Chain Act, or the Obligation to Exercise Due Diligence in the Supply Chain Act, which came into effect on January 1, 2023, was included in this iteration of the SIG questionnaire.
• The New York DFS’s Climate Guidance (ESG), which guides managing financial risks from climate change, was also included in the 2024 questionnaire.

Interagency Guidance on Third-Party Relationships

Shared Assessments also added The Interagency Guidance on Third-Party Relationships: Risk Management, released by the Board of Governors of the Federal Reserve System (the Board), the Federal Deposit Insurance Corporation (FDIC), and the Office of the Comptroller of the Currency (OCC), to its questionnaire.

The goal of the Interagency Guidance is to bring uniformity and consistency to how banking organizations develop and enforce risk management principles as they relate to third-party relationships. According to the document, “the final guidance offers the agencies’ views on sound risk management principles for banking organizations when developing and implementing risk management practices for all stages in the life cycle of third-party relationships.”

Other Updates

Lastly, Shared Assessments added version 8 of the CIS Critical Security Controls and will add SEC Cybersecurity Rule 206(4)-9 questions into the Content Library. These additions will help with greater accuracy in determining cybersecurity risk within your suppliers.

These updates include:

• The Payment Card Industry Data Security Standard PCI DSS v4.0
• ISO27001 v2022
• ISO27002 v2022
• CMMC 2.0, which requires moving from crosswalk to integration

Companies exist in a highly complex regulatory environment. These changes are indicative of that.

What Does This Mean for TPRM?

The updates to the SIG questionnaire for 2024 reflect a more nuanced and riskier environment for third-party risk managers. ChatGPT was publicly released only 12 months ago, setting off a generative AI “arms race” in the technology industry. The addition of AI to the SIG questionnaire reflects the need for companies to understand the risk AI tools pose to them and put guardrails around the technology’s usage.

Furthermore, the addition of supply chain risk management to the questionnaire reflects the emphasis on the cybersecurity supply chain risks that are permeating the modern business landscape. Organizations are seeing more third-party data breaches, necessitating a full understanding of the cybersecurity supply chain. The SIG questionnaire endeavors to answer some of these concerns, while also providing some peace of mind from understanding the controls built into your suppliers’ defenses.

How Prevalent Can Help

Prevalent offers both the SIG Core and SIG Lite questionnaires as part of our Third-Party Risk Management Platform, along with over 600 other standards-based assessment templates. This library of templates allows Prevalent customers to leverage shared data and streamline the risk questionnaire process.

Along with these assessments, we add process automations, reporting, compliance mapping, and built-in remediation guidance to streamline third-party risk management. Part of the problem with TPRM is understanding how to resolve issues that arise. With Prevalent’s remediation guidance, getting to issue resolution is no longer as much of a challenge.

We also layer on continuous monitoring intelligence to make it easier to keep track of ongoing risks in your third-party ecosystem. It’s next to impossible for any TPRM program manager to keep up with all possible risks themselves, which is why the Prevalent platform does it for you. Request a demo today to discover how Prevalent can power your TPRM program.