Answer with the controls you actually run: an inventory with named owners, least privilege scopes, an approval step before new apps are connected, periodic review, a tested revoke process and logging. Only claim what you can show with a record, and say plainly what is still in progress.
What the buyer wants to know
Behind this question are four concerns. Do you know what is connected to your systems? Can a connected app reach more than it needs? Would you notice misuse? Could you cut access off quickly? A good answer covers each in one or two sentences and offers evidence.
A model answer you can adapt
"We keep a register of connected applications with a business owner and a technical owner for each. New integrations go through an approval step that checks requested permissions against need. We grant the minimum scopes and use dedicated service accounts, not personal logins, for unattended jobs. We review the register [quarterly or yearly, say which], remove unused apps, and keep a documented process to revoke an app's access across our systems. We log connected app activity and review alerts for bulk exports. We can share the register format and a sample review record."
Replace anything that is not true. A shorter honest answer is better than a long one you cannot back up.
Evidence to offer
| Claim | Evidence |
|---|---|
| Register with owners | A redacted export or the template |
| Approval step | The written procedure and a sample approved request |
| Least privilege | A sample app with its scopes and the reason for each |
| Periodic review | A dated review record with removals |
| Revocation process | The runbook and the date of the last drill |
| Logging | A description of what is logged and who reviews it |
Words to avoid
- "All integrations are reviewed" unless you can show every one was.
- "Zero third-party risk". There is no such thing.
- Any certification or attestation claim you do not hold. If an audit is in progress, say it is in progress, not complete.
- Vendor names or customer names you have no permission to use.
If you are early on
If the register is new, say so and give a date: "We completed an initial inventory in October 2026 and review it quarterly." Dated, specific answers build more trust than polished vague ones.
Reference points
OWASP's API Security guidance advises assessing the security posture of providers before integrating, and requiring TLS for all interactions. Microsoft's and Google's documentation both describe admin controls for reviewing and restricting connected apps. Citing the control you use, in plain words, is enough. Related reading: how to tier vendors by risk in three tiers.
Try it yourself
Click through it at your own pace, or open it full screen. See how one control can map to several framework requirements, which helps you reuse a single answer across questionnaires.
Quick check
Should I attach the full register to a questionnaire?
Usually no. Offer a redacted extract or the template, and share more under an NDA if the buyer needs it.
What if we find an app with no owner while answering?
Good, that is the review working. Remove it or assign an owner, record the date, and answer based on the improved state.
Safeguard's asset discovery, policies and compliance evidence automation can help you maintain the records behind answers like this. Try the free scan at gold.safeguard.sh/scan.
Sources
- API10:2023 Unsafe Consumption of APIs, OWASP
- Review permissions granted to enterprise applications, Microsoft Learn
- Control which apps access Google Workspace data
Last reviewed: 19 October 2026.
