Control responses

A security answer carries a control code, the vendor’s response, any attached evidence and a risk rating. It belongs to one questionnaire. That relationship matters when the same control is answered for different vendors or for another questionnaire version. The Inspector should open the intended questionnaire before recording or checking a response so the Reviewer later sees the right context.

The rating is a review signal, not a replacement for the answer. A high rating directs attention to the control and its evidence. The Reviewer still needs to read what the vendor said, examine the attachment and decide what the questionnaire outcome should be. A low rating also needs its answer: the record should support why the team considered the response acceptable for the scope under review.

• Control identity. The code identifies the requirement being answered within the selected questionnaire.
• Answer and attachment. The text and evidence sit on the same response, so a reviewer need not infer which file explains which claim.
• Risk rating. Low, medium, high and critical ratings allow the team to find responses that deserve closer attention.

Set the control-code convention before importing responses. If a vendor spreadsheet uses different labels from the team’s control list, decide which code will be stored and keep that choice consistent across questionnaire versions. Agree which attachments are sufficient for each control type and who checks that the file is readable and relevant. The app holds evidence; the team still judges its quality.

Decide who can change a rating and how a change is reviewed. The Inspector can capture the response; the Reviewer should understand whether the rating represents the vendor’s own assertion or the team’s assessment. Agree whether the rating represents the vendor’s assertion or the team’s assessment so the Reviewer can interpret it consistently.

Suppose a vendor returns a control answer that describes access review but attaches evidence from an older period. The Inspector records the text, attachment and code against the active questionnaire. The Reviewer opens the elevated-risk list, reads the answer and checks the evidence against the request’s version and due date. The decision can then be made on the questionnaire with the response still linked for later inspection.

Test a second case in which two questionnaires contain the same control code. Open each response and confirm the linked questionnaire differs. That is the important boundary: a familiar code by itself does not establish that a piece of evidence supports the current vendor review. If an answer is corrected, the team should recheck the questionnaire outcome before relying on it.

• Elevated risk answers — High and critical ratings with control code, evidence and linked questionnaire.
• Questionnaires in review — The requests whose responses are being considered for a decision.

Read questionnaire review for the full response-to-decision path. The reports page explains how the team can compare elevated responses across requests.