Already in force

Regulators and underwriters don't have to prove negligence — an empty file does it for them. See what the law expects →

Works alongside · the SIG questionnaire

How SanctumShield works alongside the SIG questionnaire

By Lindsay Hiebert · Founder · CISSP

The SIG questionnaire from Shared Assessments is how vendor risk teams ask a supplier about its security. SanctumShield looks at your own organization: the AI your people and agents use, found in your own network logs, and a dated set of governance records built from your answers. Together they cover the vendors you assess and the AI you run.

What the SIG questionnaire does well

A common language for due diligence

SIG gives buyers and vendors a shared, widely understood set of questions for third-party security assessment, so a vendor anywhere knows what is being asked.

Depth when you need it

SIG Core offers comprehensive coverage for critical vendors, and SIG Lite a lighter set for the rest, so the effort matches the risk.

A foundation for vendor risk programs

Third-party risk programs and the platforms that support them build on SIG, which makes responses comparable across vendors.

A record of what the vendor stated

A completed SIG documents a vendor's own description of its controls at a point in time, ready for review and follow-up.

What SanctumShield adds

The AI your own people use

Your firewall, proxy or DNS hostnames matched against a catalog of 130 AI tools and built-in AI features, and a registry of 118 known AI endpoints matched against your network logs, so the record reflects the AI in use, including tools people adopted on their own.

Policy for your own employees

An AI Acceptable Use Policy of up to 16 sections written for your organization, with each clause tied to a regulation such as the EU AI Act, HIPAA or SOC 2.

Records your board and insurer read

An Executive Risk Report with prioritized, regulation-anchored findings and owners, a one-page Board Memo, and a Verification URL for each document.

AI questions for your vendors

A free AI Vendor Trust Questionnaire adds AI-specific questions to send beside a SIG: agents and their permissions, MCP connections, audit logs and who can stop an agent. The SanctumShield assessment itself is self-serve: Light, Standard or Complete, as much time as you choose, with the same four documents at every level.

Using both

Keep SIG for the vendors you assess. Add SanctumShield for the AI inside your own organization, and send the AI Vendor Trust Questionnaire alongside a SIG when the vendor builds or runs AI.

The result is one picture: what your vendors told you about their controls, and a dated record of the AI your own people and agents use, with the policy and owners that govern it.

What SanctumShield covers

For vendor risk and security teams that run SIG and want a dated record of the AI used inside their own organization.

130 AI tools and built-in AI features (82 tools, 48 built-in features) and 118 known AI endpoints matched against your network logs.

The assessment covers your company profile, the AI tools in use, AI built into the business software you already pay for, personal and unmanaged devices (BYOD), MCP gateways, the assurance record, document-grounded AI answers, the agent inventory and agentic posture, agent permissions and your network logs.

You receive the Executive Risk Report, AI Acceptable Use Policy, Board Memo and AI Posture Summary, each dated and downloadable as PDF, Word, HTML, Markdown and plain text, with a Verification URL for each.

Catalog and registry refreshed monthly. Latest update: October 27, 2026

Start your AI Governance Audit →

More pages like this one: how SanctumShield works alongside the tools you already use.