How to answer a control you don't have

The instinct is to soften it until it sounds like a yes. That is the version that loses deals. There is a wording that does not.

The three bad options

Faced with a control you genuinely lack, most teams choose one of three: claim it anyway, write something vague enough to seem affirmative, or leave the row blank. All three are worse than the honest answer, and the middle one is worst.

A vague answer is worse than a blank because it consumes the reviewer's goodwill. They have read thousands of these. Evasion is the most legible pattern in the genre, and once they detect it, every other answer you gave becomes suspect.

What a good gap answer contains

The gap, stated plainly. “We do not currently operate a formal threat-intelligence programme.” No hedge, no partial credit.

What you do instead. Almost no gap is total. Compensating controls belong here, described concretely and without inflating them into the missing control.

Scope. Who or what is actually affected. Reviewers routinely over-estimate the blast radius of an admitted gap; a scope sentence is your only chance to bound it.

A dated plan, or an honest absence of one. “Scheduled for Q1 2027” is strong. “Not currently on our roadmap, as our threat model does not justify it” is also strong — it demonstrates you have a threat model. “We plan to address this in future” is worthless and reads as such.

Why honesty outperforms here

Reviewers are not looking for perfect vendors; they do not exist, and a form with two hundred unqualified yeses is itself a warning sign. They are looking for vendors who know their own posture, because that is the only kind whose other answers can be trusted.

A clearly-stated gap with a compensating control and a date is evidence of a functioning security programme. It routinely scores better than a vague affirmative on the same row.

The structural version of this

In our own pipeline, a question with no support in the source documents is never drafted into a plausible-sounding answer. It is flagged, and the export refuses to complete until a named human has signed that row. The design view is that no answer is strictly better than an invented one, because an invented answer transfers risk to you silently and a blocked export does not.

That is worth adopting as a habit even without tooling: if you cannot point at the document behind a row, do not write the row — escalate it.