Plain-English meaning
A structured request for a vendor to describe security controls, practices, evidence, and responsibility boundaries.
Why it matters in a software decision
It helps route risk questions, but an answer alone is not proof that a control exists or covers the intended use.
Where you may see it
Vendor-risk platforms, procurement reviews, shared spreadsheets, trust centers, and due-diligence records.
What to verify
- Scope and answer owner
- Supporting evidence
- Exceptions and compensating controls
- Review date and follow-up actions
Do not confuse it with
A questionnaire collects representations; an independent report or test supplies a different form of evidence. Neither automatically covers every use case.
Procurement example
Ask fewer questions when reliable evidence already answers them, and record unresolved gaps with an owner and decision date.
This glossary explains procurement usage in plain English. Contract, privacy, security, accounting, and regulatory conclusions require context-specific review.