In brief
A security questionnaire guide for Vietnam SaaS and ITO teams: confirm scope, assign owners, answer with evidence, handle gaps and reuse approved answers.
This security questionnaire guide gives Vietnam SaaS and IT outsourcing teams a five-step process: confirm the scope, assign each question to the team that owns the control, answer precisely with evidence, record gaps openly, and reuse approved answers. A security questionnaire is the customer's structured review of how you protect data, manage access, build software, handle incidents and oversee suppliers.
It is not a certification audit, but a weak, inconsistent or unsupported response can still delay the deal, because the customer must investigate each uncertainty.
What does a customer security questionnaire cover?
Most questionnaires cover governance, access, software development, vulnerability management, incident response, data protection, suppliers, and continuity.
| Topic | What the customer wants to know | Supporting evidence |
|---|---|---|
| Governance | Who owns security and approves policy | Policies, role records, review minutes |
| Access | How access is approved and removed | MFA configuration, access reviews, offboarding |
| Development | How code and releases are controlled | Branch rules, reviews, tests, deployment logs |
| Vulnerabilities | How findings are detected and corrected | Scan reports, pentest, remediation tickets |
| Incidents | How events are handled and communicated | Response plan, exercises, incident log |
| Data | Where data goes and how it is protected | Data flow, encryption, retention rules |
An ISO 27001 certificate, SOC 2 report, or pentest can answer part of the review. None automatically answers product specific questions about architecture, subprocessors, data location, or contract commitments.
How do you answer a security questionnaire step by step?
- Confirm scope. Agree on the product, service, deployment, data types, regions and what the customer wants: a statement, documents or an assurance report.
- Use a controlled answer library. Start from approved answers with an owner, scope and review date.
- Assign by ownership. Route each section to the team that runs the control.
- Answer precisely with evidence. State the control, scope and frequency; attach the minimum evidence.
- Record gaps. Log the gap, risk, compensating measure, owner and decision instead of hiding it.
The sections below explain each step.
Confirm scope before assigning questions
Clarify the product, service, deployment model, data types, regions, and customer use case. Ask whether the customer wants a statement, documentary evidence, or a specific assurance report.
This step prevents a common error: answering for company wide practices when the evaluated service uses a different environment or process.
Use a controlled answer library
Store approved answers with an owner, approval date, evidence link, applicable scope, and next review date. Separate reusable facts from customer specific commitments.
A good answer library is not a document filled with "yes." It records the condition behind the answer. For example, encryption at rest may apply to customer production data but not to every development artifact.
Assign questions by ownership
Use the team closest to the source:
- Security or compliance for policies, risk, and incidents.
- Engineering for SDLC, logging, and technical architecture.
- IT for identity, endpoints, and access reviews.
- HR for screening, training, and offboarding.
- Legal or privacy for contracts, personal data, and subprocessors.
- Operations for continuity and recovery.
One coordinator should check consistency across sections before submission.
Answer precisely and attach suitable evidence
State the current control, its scope, and any relevant frequency. Avoid absolute claims such as "we never" unless the control and evidence support them. If a requested control is planned, mark it as planned and provide an approved target date instead of describing it as complete.
Share the minimum evidence needed. Redact secrets, personal data, customer names, internal addresses, and unrelated findings. Use time limited access where possible and record what was disclosed.
Resolve exceptions through a visible workflow
When the customer's requirement is not met, record the gap, risk, compensating measure, owner, decision, and due date. Some gaps require remediation. Others may require a contract clarification or a customer risk acceptance.
Do not allow a salesperson to create a security commitment without the operational owner reviewing it. Questionnaire answers can become part of the commercial record.
How can teams reduce repeated questionnaire work?
Maintain one evidence backed knowledge base, link answers to controls, and review high change items such as subprocessors, hosting locations, security contacts, certifications, and retention schedules. Track which answers were sent to each customer so later changes can be handled consistently.
For the evidence behind your answers, see automated evidence collection; for choosing a platform, see compliance automation platforms for Vietnamese companies.
Where does pTrackly help, and where does it not?
pTrackly keeps the material behind your answers current: policies go through approval before they are published, and evidence tasks are linked to controls with an owner, a frequency and a review date. The Trust Portal publishes your frameworks, controls and subprocessors, and shares policy files, certificates and other documents only after the requester signs an NDA and you approve access. Ask Tracky, the built-in AI assistant, helps find the relevant policy or evidence in your own data. pTrackly does not write or submit questionnaire answers for you; your organization remains responsible for the accuracy of every answer. See the solution for SaaS companies and solution for IT outsourcing teams.
Frequently asked questions
Does an ISO 27001 certificate or SOC 2 report replace a security questionnaire?
No. They answer part of the review, but customers still ask product-specific questions about architecture, subprocessors, data location and contract commitments.
What should we do if we do not meet a requirement in the questionnaire?
Say so. Mark the control as not in place or planned with an approved target date, describe any compensating measure, and record the gap, owner and decision.
How much evidence should we share with the customer?
The minimum needed to support the answer. Redact secrets, personal data, other customers' names and unrelated findings, prefer time-limited access, and record what you disclosed.
Who should approve answers before they are sent?
The operational owner of each control reviews its answer, and one coordinator checks consistency. Commitments that change contract terms need management or legal approval.
References
This guide provides general operational information. Contract and legal commitments should be reviewed by qualified advisers.
