Score each answer by the evidence behind it, not by whether it says yes. A simple four level scale works: no answer, a claim, a claim with a described control, and a described control with evidence you can inspect. Total only the questions that matter for the product's risk.
Why yes or no scoring fails
A vendor can answer "yes" to nearly every question. Counting yeses rewards the vendor with the best writers. What you want to know is whether the control exists and whether you can verify it. NIST SP 800-161 Rev. 1 points out that organizations have limited visibility into how the technology they acquire is developed and maintained. A questionnaire is a way to increase that visibility, but only if answers can be tested.
The four levels
| Level | Meaning | Example |
|---|---|---|
| 0 | No answer or not applicable without reason | Blank, "see website" |
| 1 | Claim only | "We encrypt data" |
| 2 | Claim with a described control | "AES encryption at rest, keys held in a managed key service, rotated on a schedule" |
| 3 | Described control plus evidence | The above, plus the policy document or a relevant report extract |
Use the scale on each question that matters. Some questions deserve a skip, such as controls irrelevant to the product.
Which questions to weight
Do not weight everything equally. Pick the handful tied to the way you will use the product:
- Data handling and location, if the product stores your data.
- Patch handling and disclosure, for any product.
- Authentication and logging, for anything with user accounts.
- Subprocessors, for hosted services.
- Incident notification, for any vendor that touches your data.
Give those two or three times the weight of the rest, and write the weights down before you read the answers. That avoids shaping the weights around a favored vendor.
Red flags to downgrade
- Answers that copy marketing text and do not address the question.
- "We follow best practices" with no named practice.
- Answers that contradict the vendor's own public pages.
- Evidence that is out of date or that covers a different product.
- Refusal to give any evidence even under a confidentiality agreement.
See our post on red flags in vendor questionnaire answers.
What to do with the result
A score is a conversation starter, not a verdict. For each level 0 or 1 answer on a heavily weighted question, send a follow up. Record the vendor's reply and score it again. Decide a threshold in advance: for example, no level 0 on any weighted question, and a written plan for each level 1.
If the vendor falls short but the product is still your choice, write the residual risk down with an owner and a review date, and consider compensating controls.
Quick check
Should every question count equally?
No. Weight the questions tied to how you will use the product, and set weights before reading answers.
Is a questionnaire enough on its own?
No. Pair it with evidence, an intake check and ongoing monitoring.
Safeguard's compliance and evidence automation can help you produce evidence for your own answers when customers send you questionnaires.
Sources
Last reviewed: 19 October 2026.
