Answering a security questionnaire when you don't have the control

You are on question 61 of a vendor security questionnaire. It asks whether you run endpoint detection on every laptop, or whether you have had a third-party penetration test this year. You do not. The deal is waiting, the cell has a “Yes / No” dropdown, and “Yes” is right there.

Don’t. This guide covers why a guessed answer costs more than a gap does, how to describe a compensating control without stretching it, how to phrase a roadmap item so a reviewer can use it, and what reviewers tend to accept. It is general information, not legal advice.

Why guessing creates liability

A completed questionnaire is a set of statements of fact, made to a customer who is about to decide whether to trust you with their data. That is the whole reason it exists. Three things follow from it.

• It may become part of the deal. One questionnaire vendor writes that answers often become part of a binding contractual relationship, and that many enterprise agreements include representations and warranties about security posture. Whether yours does depends on the paper you signed, so read it. If you are unsure, ask a lawyer before you answer, not after.
• A false answer does not need a lie behind it. Cornell’s legal encyclopedia describes fraud as a false statement of fact made knowing it is false or recklessly disregarding whether it is true, intending that the other side rely on it. Negligent misrepresentation is the milder cousin: in one Florida law firm’s description, the speaker believed the statement was true but should have known it was not, and the other side reasonably relied on it. That firm lists damages and cancellation of the contract among the remedies. Rules differ by state and by contract, so treat this as an example of how the argument runs, not a forecast.
• Insurance may ask. One questionnaire-software vendor writes that cyber insurers compare answers with what turns up after an incident. It cites no cases, so read your own policy.

Now look at what “guessing” usually means in practice. It is rarely a deliberate lie. It is “Yes” for a control that is half rolled out, “N/A” for something nobody checked, or an answer pasted from the last customer’s sheet. Each one is a statement of fact that nobody verified. The answer to that is boring: ask the person who runs the system, and write down what they say, not what the question hopes for.

Compensating controls, described honestly

NIST defines a compensating control as a control used in place of a recommended one that provides “equivalent or comparable protection.” That definition comes from NIST’s own baselines for federal systems, and a customer questionnaire is not one of those. The idea still travels, and it is a useful test for whether the thing you want to write down deserves the name.

The PCI Security Standards Council’s payment card standard is stricter. A compensating control there needs a legitimate, documented technical or business constraint, and it cannot be used to retroactively address a requirement that was missed in the past. You need not follow PCI to borrow its questions. Four are worth asking of any control you plan to offer:

1. Why can’t you do the stated thing? Is there a real reason?
2. What is the stated control for? What risk does it address?
3. Does what you run today address that same risk, in practice?
4. Is it running now, and can someone show it?

A hypothetical, to make it concrete. The question asks for a centralized log management system. You have none. What you have is your cloud provider’s audit logs, kept for 90 days, with two alert rules that email the founder. That is not a log management system, and you should not call it one. It is a partial control. Say so:

“No. We do not run a centralized log management system. We retain the cloud provider’s audit logs for 90 days and alert on two events: root sign-in and changes to access policies. Alerts go to the founder.”

That answer gives the reviewer a fact and lets them decide whether it is enough. Calling it “equivalent” makes the decision for them, and wrongly if they push on it. If the compensating control is not running today, it is a roadmap item, and it goes in the next section.

How to phrase a roadmap item

NIST’s plan of action and milestones, the control called CA-5 in SP 800-53, is a good model. The control asks an organization to document the “planned remediation actions” that correct a weakness. One compliance vendor’s summary lists what a plan of action holds: the weakness, the planned corrective action, who is responsible, the expected completion date, and the current status. Those five fields fit in three sentences.

An example answer (fictional):

“No, not yet. We have not had a third-party penetration test. Today we run automated dependency scanning on every release. We plan to commission a third-party test in Q1 and can share the summary once it is complete. Owner: the founder.”

Four rules keep it honest:

• Keep the answer a “No”. A plan does not turn the control on. If the dropdown offers only Yes and No, choose No and put the plan in the comment column. Choosing “Yes” on the strength of next quarter is the mistake this guide is about.
• Say “plan” only if there is one. “In progress” means someone is doing the work this month. If the plan is an intention, write “we intend to” and leave off the date.
• A date is itself a statement. Give one only if you will keep it, and call it a target. If it slips, tell the customer before they ask.
• Name an owner. A plan with no owner reads as a wish.

What reviewers tend to accept

We have no survey of reviewers to cite, and every reviewer sets their own threshold. This is our judgment, and it matches the public advice we found.

A reviewer reads a hundred answers and cannot verify most of them. What they can do is judge whether an answer sounds like someone who knows their own environment. In a questionnaire vendor’s words: reviewers “cannot tell the difference between ‘we do not have this and have not thought about it’ and ‘we do not have this yet but know exactly why.’” The same author calls a blank field or an unexplained “N/A” the most common cause of a second round of follow-up questions. That company sells questionnaire software, so weigh it accordingly.

• Usually accepted: a plain “No” with a reason, a partial control described as partial, a compensating control that is running and can be shown, and a plan with an owner.
• Usually not: a blank, an unexplained “N/A”, an absolute (“all data is always encrypted”), a claim your other documents contradict, and a control described as live that turns out to be planned.

One more honest point. Some gaps will cost you the deal. If a customer requires MFA everywhere and you have it nowhere, a truthful “No” may end the conversation. That is a worse Tuesday than a “Yes”, but a better year: a deal you win on a false answer is a deal you hold on a false answer, with the contract language above attached. And there is no answer, however well phrased, that guarantees a customer will approve you.

If you would rather hand it off

Blank Slate Creative, LLC answers vendor security questionnaires. This guide draws on public standards and sources, not client work.

The service works the way this guide does. You tell us what you run and we write it down plainly, gaps included. We will not write an answer for a control you don’t operate, and we can’t promise a customer will approve. It is readiness and documentation work only: never an audit, an attestation, or a certification, and not a penetration test. It is a flat fee: up to 125 questions is $85, and 50 more is +$45, so up to 175 is $130. Order the questionnaire, $85.

Sources

All read on 2026-09-30. Talk to a lawyer about your contract.

• NIST Computer Security Resource Center, glossary entry compensating security control (definitions from SP 800-30 Rev. 1, SP 800-39, and SP 800-137).
• PCI Security Standards Council, PCI DSS v4.0: Compensating Controls vs Customized Approach (PCI Perspectives blog, July 2022; documented constraint, no retroactive use). We did not read the standard itself.
• NIST SP 800-53 Rev. 5, control CA-5, Plan of Action and Milestones (control statement, as reproduced at csf.tools). The list of plan fields is from UpGuard’s CA-5 page, a compliance vendor’s summary.
• Jimerson Birr, Negligent Misrepresentation (a Florida law firm’s description; Florida law only, an example).
• Cornell Legal Information Institute, Fraud (the elements of fraud; general, not jurisdiction-specific).
• Wolfia (questionnaire software vendor), What inaccurate security questionnaire answers cost you (May 2026; no cases cited; the contract and insurance points) and When a security questionnaire asks for evidence you lack (July 2026; the reviewer quote).