Answer "Not applicable" only when the control cannot logically apply, for example a question about physical servers when you run entirely on a hosted platform. If the control applies but you meet its goal differently, answer partial and describe the compensating control. Always add one sentence of reasoning.
Three situations
| Situation | Answer | Example |
|---|---|---|
| The thing does not exist in your environment | Not applicable, with reason | "We operate no physical data center. Facilities controls sit with our hosting provider." |
| The thing exists, you meet the goal another way | Partial or yes, with compensating control | "We do not use hardware tokens. We use phishing-resistant authenticators from the platform." |
| The thing exists and you do not meet the goal | No, with plan | "Not yet implemented. Planned for the stated quarter." |
Test before choosing N/A
Ask whether a reasonable reviewer could say "but you do have that". If your product stores data, a question on data retention applies. If your team uses contractors, a question on personnel screening applies. When unsure, treat it as applicable.
Writing a compensating control answer
Use this order:
- The requirement as the buyer stated it.
- Why you do not meet it literally.
- What you do instead.
- Why that achieves the same goal.
- Evidence.
Keep it short. A buyer reading a hundred rows will skim, so put the control first and the reasoning second.
Inherited controls
A common legitimate case is a control a platform provider operates for you. Say it is inherited, name the control area, and say how you review the provider. You still own the question of whether you chose a suitable provider, so avoid answering as if the control were irrelevant. For related thinking see SOC 2 cloud shared responsibility: which controls are yours.
Common mistakes
Using N/A to skip hard questions. Reviewers learn quickly to read repeated N/A as evasion and may reopen earlier answers. Another mistake is claiming a compensating control without evidence. If you cannot show it, say it is planned.
Track your N/A answers
Keep a list of every N/A with its reason in your answer library. When your architecture changes, review that list first. See build a security questionnaire answer library.
Review N/A answers after changes
A control that did not apply last year can apply now. Adopting a new data store, hiring contractors, or shipping a mobile app can each turn an old N/A into a gap. Add a step to your change process that asks whether any recorded N/A answers are affected, and update the library when they are.
Quick check
Can an auditor challenge an N/A answer?
Yes. Be ready to show the architecture reason behind it.
Is a compensating control always accepted?
No. It is accepted if the buyer agrees it meets the intent. Offer a call if they hesitate.
Safeguard provides framework mapping and evidence automation, with a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
