Answer with what you actually do, in specific terms, and offer evidence for each answer. Say how often you scan, how you rank findings, how fast you fix each rank, and how you handle exceptions. Do not promise timelines you do not meet, and do not describe plans as completed work.
Why customers ask
Regulated customers must oversee their service providers. The FTC Safeguards Rule, for institutions it covers, asks them to periodically assess service providers based on the risk they present. New York's rule asks for due diligence and periodic assessment, with attention to providers' practices and contractual representations about cybersecurity. Your answers become part of their file, and sometimes of their own examination.
Ten questions and how to answer
| Question | How to answer | Evidence to offer |
|---|---|---|
| Do you have a written vulnerability management policy? | Yes or no, with approval date | Policy excerpt |
| How often do you scan? | State actual cadence per system type | Scan schedule |
| What do you scan? | Code, dependencies, containers, hosts, as true | Scope list, gaps named |
| How do you rank findings? | Severity, exploitation, exposure, asset importance | Ranking criteria |
| What are your fix timelines? | Your policy targets, not aspirations | Policy and attainment data |
| What about exploited vulnerabilities? | Describe the fast path | Emergency procedure |
| How do you handle exceptions? | Approver, compensating control, expiry | Exception process |
| Do you do penetration testing? | Frequency and who performs it | Summary letter |
| How do you track third party components? | Describe SBOM or inventory practice | Sample SBOM |
| How do you notify customers? | Your incident notice commitments | Contract language |
Rules for truthful answers
- Use present tense only for what operates today. Say "in progress" for work underway, and give a date only if you intend to meet it.
- Do not name certifications or attestations you do not hold. If a report is in progress, say that plainly.
- Give ranges you actually achieve. If you fix critical issues faster than the rest, give both numbers and your attainment.
- Name what is out of scope. It builds trust.
- Keep one answer library, reviewed by security, so different salespeople do not give different answers.
Evidence that persuades
A short redacted export of dated scan results, an anonymized sample trail from detection to verified fix, and a summary of the latest penetration test and retest persuade more than adjectives. Share raw findings only under confidentiality, as discussed in our post on who should access vulnerability reports.
When the honest answer is weak
If you do not scan something, say so and describe the compensating control or the plan with an owner. Reviewers see many programs. A clear gap with a plan is easier to accept than a vague claim they later find untrue.
Keep answers consistent over time
Date every answer. When practice changes, update the library. When a customer asks again next year, you can show what changed.
Where tooling helps
Safeguard produces SBOMs, scan results and findings history that can back the evidence column, and compliance mapping helps align answers to frameworks. Review everything for accuracy before it leaves the building.
Quick check
Should we share our full scan report with a customer?
Usually a redacted summary is enough. A full report is sensitive, so share it only under confidentiality and with a record.
What if a customer asks for a timeline we do not meet?
Give the timeline you meet, and explain your faster path for exploited flaws. Do not agree to a number you cannot hit.
Sources
- 16 CFR 314.4(f), Safeguards Rule oversight of service providers
- 23 NYCRR 500.11, Third party service provider security policy
Last reviewed: 19 October 2026.
