Answering a security questionnaire

Sooner or later somebody in security, audit or a customer's procurement team sends a questionnaire, it arrives with a deadline, and it lands on the platform administrator. The method: separate the questions into what the platform provides, what you have configured, and what you have chosen not to configure — the first is documented and citable, the second is your evidence, and the third needs an owner and a rationale rather than a blank. Never guess, and never claim a control you have not configured just because the platform supports it; availability is not implementation. Plus the artifacts to keep ready so the next one takes an hour instead of a week.