Establish the service being assessed
The buyer may use only one SaaS product while the questionnaire asks about “your company.” Confirm the contracting entity, product, deployment model and data involved. Practices may differ across products; do not apply one platform’s controls to the whole group without checking.
Separate facts, checks and gaps
Some answers can be supported by existing evidence, such as access policies and recovery procedures. Others require verification by an owner of the actual environment, such as encryption settings or log retention. A third group exposes missing controls or records. Explain the current state and remediation plan rather than marking a control as operating when it is not.
| Subject | Internal owner | Typical evidence |
|---|---|---|
| Access | Security, engineering, IT | Approvals and periodic review records |
| Changes | Engineering, operations | Code reviews and deployment records |
| Suppliers | Procurement, security | Supplier inventory and assessments |
| Incidents | Security, operations, management | Exercises and response records |
| Privacy | Legal, privacy lead | Notices, agreements and data flows |
Maintain a usable answer library
Version the answers and record which product, date, approver and evidence each answer relates to. Reuse facts across questionnaires only after checking definitions, scope and confidentiality. Do not send architecture diagrams or customer data to unverified recipients.
Decide whether independent evidence is also needed
A questionnaire alone does not necessarily mean the buyer requires a third-party report or certificate. Read the procurement terms for a separate SOC 2, ISO/IEC 27001 or other evidence requirement. If the buyer asks only about current controls, provide an accurate response. If independent evidence is required, plan the scope and specialist involvement separately.