A gap statement is a short, truthful reply that says what you do not have yet, what you do instead, who owns closing it and by when. Write it in four parts: current state, interim control, plan, and date. It almost always lands better than a stretched yes, because reviewers can verify it.
Why a clear no can help
Reviewers read many questionnaires. A stretched yes is easy to spot when the evidence request comes back thin. A clear no with a plan reads as a team that knows its own posture. It also protects you later: you cannot be caught contradicting a claim you never made.
The four parts
- Current state. One plain sentence on what exists today.
- Interim control. What reduces the risk in the meantime.
- Plan. The specific work, with an owner role.
- Date. A target date and when you will update the customer.
Template
"We do not currently [control]. Today we [interim control]. We plan to [specific change], owned by [role], targeted for [date]. We will confirm completion to you in writing."
Examples across common gaps
| Gap | Weak answer | Gap statement |
|---|---|---|
| No independent pen test yet | Yes, we test regularly | No independent test yet. We run automated scans each release and plan an independent test, owned by the head of engineering, targeted for a stated quarter |
| MFA not on one legacy tool | Yes | MFA covers all staff systems except one internal tool, which is limited to a small group on the company network and scheduled for replacement or MFA by a stated date |
| No formal DR test | Yes | Backups run daily and are monitored. A full restore test has not been performed. We will run one in a stated month and share the result |
Use real details in your own versions. The examples show structure, not numbers.
Rules for writing them
- Use plain words. No "essentially", "largely" or "in most cases" unless you define them.
- Give a date you will keep. Add a buffer to the date you would pick privately.
- Name a role, not only a person, so the commitment survives departures.
- Do not promise a certification or report by a date that depends on someone else's schedule. Say what you control.
- Put the commitment in your commitments register so it is tracked after the deal closes.
Handling the follow up
A reviewer may ask whether the gap blocks the deal. Let them decide. Offer to discuss the interim control in detail and to send an update on the date you named. If the gap is serious for their use case, better to learn that early than after signing.
Mistakes to avoid
- Hiding the gap in a long comment field.
- Marking a partial control as yes with a footnote nobody reads.
- Promising a fix date that engineering has not agreed to. Get the owner to approve the date before it goes out.
- Forgetting to follow up. A missed update on a stated date is worse than the original gap.
Where Safeguard fits
Safeguard's compliance and evidence automation can track the gap, the owner and the due date alongside the controls that already pass, so commitments do not live only in an email thread. A free scan is at https://gold.safeguard.sh/scan.
Quick check
Will a no lose the deal?
It can, but a stretched yes that fails verification does more damage. A clear no with an interim control and a dated plan is often accepted.
Who approves the date in a gap statement?
The owner who will do the work, plus whoever approves external security claims.
Last reviewed: 19 October 2026.
