When a vendor gives a vague security answer, ask four follow-ups: which specific control, since when, covering which systems, and what evidence can you share. Replace broad questions with ones that have a checkable answer. A vendor with real controls can usually answer in a sentence.
Spot the vague answer
Common patterns:
- "We follow industry good practice."
- "Data is encrypted." (Where, and with what key management?)
- "We are compliant." (With what, audited by whom, as of when?)
- "Our team monitors this." (Who, how often, with what alerting?)
None is necessarily false. They are just not checkable. Your job is to turn them into statements you could verify.
Follow-up pattern
Use this four part question for any answer: What exactly, since when, covering what, shown how?
| Vague claim | Follow-up |
|---|---|
| "Data is encrypted" | In transit and at rest? Which systems and backups? Who holds the keys? |
| "We do penetration tests" | When was the last one, who did it, and what was the scope? Can we see a summary? |
| "We patch promptly" | What is your target time for critical issues, and how did you perform against it last quarter? |
| "We have access controls" | Is multi factor authentication enforced for staff and admins? How often is access reviewed? |
| "We are certified or audited" | Which attestation or certification, for which scope, and what period does the report cover? |
| "We have an incident plan" | When was it last tested? How quickly would you notify us? |
Do not accept a claim that sounds like a certification unless they name it. If a vendor says an audit is in progress, ask for the expected date and what you can see meanwhile. Be careful to treat "in progress" as exactly that.
Ask for evidence that fits the claim
Evidence does not have to be a full report. Useful forms include a policy excerpt, a screenshot of a setting, a summary letter from an assessor, an exported list showing enforcement, or a recorded walkthrough. Match the request to the risk. A vendor holding your regulated data deserves more than one holding a marketing list.
Keep the tone constructive
A good follow up does not accuse. Try: "Thanks. To make sure we record this accurately, can you tell us which systems that covers?" This gives the vendor an easy way to supply detail and shows you are documenting the answer.
Decide what to do with unanswered questions
If a vendor cannot or will not answer, note the gap. Options include accepting the risk with a limit on data shared, asking for a contractual commitment, requiring a compensating control on your side, or choosing another supplier. Whatever you pick, write it down with an owner and a review date.
Record the final answers
Store the question, the answer, the date and who gave it. When you review the vendor next year, you will want to compare against what they said before, and vague answers will stand out.
Safeguard's compliance and evidence automation helps teams keep their own answers consistent when customers send these same questions to them. The free scan at gold.safeguard.sh/scan is one source of evidence for dependency questions.
Quick check
Is a vague answer a red flag?
It is a gap to close, not proof of a problem. Ask the follow-ups and judge the specific answers.
How much evidence should I ask for?
Scale it to the data and access the vendor will have. Summaries and screenshots are often enough for low risk.
Last reviewed: 19 October 2026.
