Have you experienced a security breach or data incident in the last 24 months?

This is the question people most want to answer quickly, and the one where speed does the most damage.

A "no" here is not the absence of a fact. It is a positive claim that you would have detected an incident if one had happened, and everything else on the questionnaire is being read as evidence for or against that claim. If two rows earlier you said logs are retained for thirty days and nothing monitors them, a reviewer now has a company asserting a clean record it has no instrument to observe. That is worse than disclosing something small.

Say what threshold you are answering against. Most incident response plans define a reportable incident, and most answers do not mention it. Without one, "breach" means whatever the reader assumes, and readers assume broadly: a phishing email somebody clicked, a laptop left on a train, a misconfigured bucket found by a researcher. With a threshold stated, your answer is checkable and narrow. Without it, you are making an unbounded promise about two years of history.

A disclosed incident handled well is not a lost deal. Security teams have all seen incidents; what they are reading for is whether you noticed, how fast you told people, and what changed. A company that says "yes, here is what happened and here is the control we added" is often in a better position than one asserting perfection, because the first is verifiable and the second cannot be.

Where this product will leave the box empty. If your documents contain an incident response plan but no register, this comes back as a gap rather than a "no". That is deliberate and it is the correct behaviour: nothing in a policy document is evidence about what did or did not happen, and answering from a policy alone would be inventing a fact about your history.