Answer with a defined scope: state what counts as a breach, the period you are covering, and whether any incident affected customer data. If one did, describe it factually, say what changed, and have legal review the wording. Never answer "no" unless every term in the question is true.
Pin down the question first
The word breach means different things to different people. A buyer may mean any unauthorised access, while your lawyers may mean a legally notifiable event. Write the definition you are answering under at the start of your response. Ask the buyer for their lookback period if it is not stated, and answer for exactly that period.
Three honest answers
| Situation | How to answer |
|---|---|
| No incident touched customer data in the period | "No. We have had no security incident that resulted in unauthorised access to customer data in the past N years." |
| Incident occurred, customers notified | State that it occurred, when, what category of data, that affected customers were notified, and what you changed |
| Incident under investigation | Say it is under investigation, say what you can, and name a contact who can update the buyer |
Notice that the first answer is narrow and checkable. "We have never been attacked" is neither.
What a good incident answer includes
- A plain statement of what happened and the date range.
- The category of data involved, without unnecessary detail.
- Confirmation that affected parties were told, if they were.
- The corrective action, such as a control added or a process changed.
- A contact for follow-up questions.
Do not name individuals, speculate about attackers beyond what you have confirmed, or share forensic detail that would help a future attacker.
Coordinate before replying
Treat this question as a legal review item, not a routine one. Keep an approved incident statement ready so answers are consistent across buyers. See third-party vendor breach: how to tell your customers for the notification side.
Also answer the related question
Many buyers follow with "how would we find out?" Point to your notification commitment: who is told, by what channel, and within what time after confirmation. Only state a time period if it is in your contract or policy.
Keep one approved statement
Write the incident statement once, have legal approve it, and store it in your answer library with a review date. Sales and security should both pull from it. When two buyers receive different descriptions of the same event, the difference is what they remember. Review the statement after every new incident and at least once a year, even when nothing has happened, so that the lookback period stays accurate.
Quick check
Can we decline to answer?
You can say details are shared under NDA, but a flat refusal tends to end the review. Give the scoped answer and offer detail under NDA.
Does an incident at one of our vendors count?
If it affected customer data or your service, yes, mention it. If it did not, say so explicitly so the buyer sees you assessed it.
Safeguard offers compliance and evidence automation that helps keep incident and response records organised, and a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
