Answer with the methods you actually run, how often, what they cover, what they miss, and the evidence you can share. Do not claim complete visibility, because no method has it. A specific, bounded answer reads as more credible than a sweeping one, and it holds up when the buyer asks a follow-up.
What the buyer is really asking
The question usually reads something like "Do you maintain an inventory of approved software and detect unauthorized software or services?" The buyer wants to know two things: that you have a list, and that you would notice if something outside it appeared.
AI tools now appear in the same questions, often as a separate line: "Do you have a policy on employee use of AI tools, and how is it enforced?"
Build the answer from facts
Before you write a word, list what is true today. For each item, note frequency and owner:
- Approved list: where it is kept, who maintains it, last review date.
- Dependency checks: how new packages are detected, for example lockfile comparison on pull requests.
- Third-party app reviews: OAuth and integration reviews on your source host and identity provider, and how often you run them.
- AI tool policy: where it is written, how people learn about it, how requests are approved.
- Repo searches: for AI libraries, keys and model files, and how often.
If an item is not done, leave it out of the answer. You can mention it as planned only if it has an owner and a date.
A structure that works
| Part | Example wording pattern |
|---|---|
| Statement | "We maintain a list of approved dependencies and review changes through pull request checks." |
| Method | "New packages are compared with the list on each pull request, and we sweep all repositories monthly." |
| Scope | "This covers application repositories. Developer machines are covered by a separate process." |
| Limit | "Tools used outside company systems are addressed through policy and training." |
| Evidence | "We can provide the approved list format, the policy and a sample of recent review records." |
Notice the limit line. Saying what is outside the scope is not a weakness. It shows that you know where your edges are.
Words to avoid
- "Complete," "100 percent" or "all" about visibility.
- Names of certifications or attestations you do not hold. If an audit is in progress, say it is in progress, not done.
- Descriptions of tools you plan to adopt as if they were running.
- Claims about preventing data loss that you cannot back up. Say what you review and what you log.
For related wording, see how to answer 'do you have a software inventory' and AI-generated code questions in security questionnaires.
Keep answers consistent
Store the approved wording in one place and reuse it. Inconsistent answers across questionnaires are a bigger trust problem than a modest answer. Review the text after any process change.
Quick check
Can we say we prevent shadow IT?
Be careful. Say you detect, review and respond. Prevention claims are hard to support, and a buyer may ask how.
What evidence is reasonable to offer?
The policy, the format of the approved list, and a sample of review or exception records, with sensitive details removed.
Safeguard offers compliance and evidence automation, asset discovery, and a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
