Answer Yes only when the control is in place, applied to everything the question covers, and you could show evidence today. Use Partial when it covers some scope, and say which. Use No when it does not exist. Use Not applicable only with a reason.
The test for Yes
Before you write Yes, ask three things. Is it in place now, not planned? Does it cover the whole scope the question names? Could you produce evidence within a day if asked? If any answer is no, you do not have a clean Yes.
When Partial is the honest answer
Partial is not a hedge. It means a real control exists with a known boundary. Good Partial answers name the boundary.
Weak: "Partial." Better: "Partial. Multi-factor authentication is enforced for all staff accounts on our identity provider. It is not yet enforced on two legacy internal tools, which are scheduled for migration."
The better version tells the reviewer what to weigh and shows you know your own estate.
When to say No
No is fine. Most reviewers expect some Nos and distrust a spreadsheet of perfect Yeses. Add one line on context if it is true and relevant: "No. We do not run a dedicated security operations center. Alerts route to an on call engineer."
Not applicable needs a reason
N/A without a reason looks like avoidance. "Not applicable. We do not process payment card data; payments are handled by a third party and card numbers never reach our systems." That is checkable and clear.
Words that cause trouble
- All, always, never. Absolutes are easy to disprove.
- Compliant, certified. Use only if the attestation or certification exists, and name it.
- Industry standard. Say which standard.
- Regularly. Give the interval.
Match the short answer to the prose
A frequent error is a Yes in the box and a caveat in the comment. Reviewers who read only the box get a false picture, and reviewers who read both lose trust. Make the box and the text agree.
Date your answers
Add "as of" when the answer depends on a state that changes, such as a migration under way. It protects you later and shows care now.
Quick check
Is a planned control a Yes?
No. Say it is planned and give a date only if you control that date. Otherwise answer No or Partial.
Can we answer Yes if the policy exists but practice varies?
Not cleanly. A policy that is not followed everywhere is a Partial, and the gap is what a reviewer would find.
Last reviewed: 19 October 2026.
