A digital workplace IT manager reviewing a vendor security questionnaire checklist with evidence attachments on a laptop, beside a Microsoft 365 analytics dashboard

IC analytics security questionnaire: the answers IT asks for

By Nicolas Saliba · Published November 2026 · 9 min read

In short

A security questionnaire for IC analytics works when every answer names its evidence, its scope and its owner. Here is how to structure the questions IT asks, what evidence satisfies them, and which controls stay yours under Microsoft's shared responsibility model.

Key takeaways

Structure the questionnaire around four risk groups: data flow, identity, security operations and lifecycle risk.

In SaaS, Microsoft's shared responsibility model keeps data, configurations, identities and access management with the customer.

Tenant-wide admin consent in Microsoft Entra ID is a sensitive operation restricted to roles like Privileged Role Administrator.

Record every questionnaire answer as evidence with a status, an owner and a review date; unresolved items become explicit decisions.

Ask for current, scoped certificates and policies: confirm scope and dates, since historical marketing claims are not evidence.

Which risks should the questionnaire actually cover?

A security questionnaire earns its keep when every answer names three things: the evidence that supports it, the scope that evidence covers, and the person accountable for it. Everything else is assertion. Microsoft's risk assessment guidance for the cloud frames what you are actually testing: whether a system and its data introduce new or unidentified risks into your organization, with the focus on the confidentiality, integrity, availability and privacy of information processing, and identified risks kept below your accepted internal risk threshold.^[1]

One nuance matters before you write a single question. A cloud provider may address the same risk with a different set of controls than your on-premises stack would use, and that approach is legitimate.^[1] So ask which control addresses the risk and what evidence proves it operates, not whether the vendor replicates your internal control catalogue line by line.

Data flow: which employee data the analytics platform reads (post views, reactions, profile attributes), where it is processed, and which subprocessors touch it.
Identity: which accounts, Microsoft Graph permissions and admin consents the tool needs, and who approved them.
Security operations: logging, monitoring, change management and how the vendor's own operators are controlled.
Lifecycle risk: what happens to your data at offboarding, contract end and deletion requests.

What evidence supports identity and access answers?

Identity answers fail when they say "we integrate with Entra ID" and stop there. A defensible answer is built from three artifacts, and your questionnaire should name them explicitly so the vendor knows what "yes" has to look like.

Evidence	What it shows	What to verify
Permission matrix	Every Microsoft Graph permission the tool requests, mapped to the feature that needs it	Each permission has a stated purpose; nothing is requested "just in case"
Vendor role model	How the vendor's own operators access the platform and what least privilege means in practice	Named roles, separation of duties, how support access is granted and revoked
Authentication documentation	Entra ID integration, MFA and conditional access behaviour	Whether conditional access policies you set in your tenant actually apply to the tool's access

Insist on the same specificity in the answers you receive: "Sites.Read.All, needed to aggregate intranet page reach" is an auditable answer, while "standard Microsoft 365 access" is not. Naming things specifically is what separates evidence from reassurance.

How should hosting and subprocessors be documented?

Hosting answers are only valid for the deployment you are actually buying. A trust-centre page describing "EU hosting" tells you nothing about your instance if the vendor runs multiple regions or deployment models. Collect three pieces of deployment-specific evidence instead.

Hosting location and data residency for your instance, stated for the specific tenant and service tier you are purchasing.
A current subprocessor list, with each party's role (hosting, support, email delivery) and processing location.
A data processing agreement under GDPR Article 28, with the terms that make it enforceable.

Two checks keep this honest. First, match every claim to a date and a scope: a certification from three years ago, or one that covers a different product line, is historical marketing, not evidence. Second, if employee representatives or a works council are involved in the decision, our works council playbook sets out how to run the analytics conversation under GDPR before the questionnaire goes out.

What proves retention and incident handling?

Retention and incident answers rest on two documents, and both must be current and scoped. A retention policy without a scope statement is a slogan: you need to know which data, in which systems, is kept for which period, and what happens when the period ends.

A dated retention and deletion policy that states its scope: which data categories, which systems, which retention periods, and the deletion mechanism at end of life.
An incident response policy with a defined notification flow: who detects, who decides, who notifies you, and within what timeframe the vendor commits to inform you.
Evidence that the documents apply to the service you are buying, not to a different product or an older platform version.

The retention scope you collect here also feeds your own compliance work: it determines what your analytics processing actually involves, which is a required input when you screen whether a DPIA is needed for the deployment.

Which controls remain the customer responsibility?

Microsoft's shared responsibility model draws the line cleanly for a SaaS service: the provider manages security of the cloud, while you always retain responsibility for your data, your configurations and settings, your identities and users, and your access management, including role-based access control, multifactor authentication and conditional access policies.^[2] A questionnaire that ignores this split produces a misleading file: it can read as if the vendor operates controls that are, in fact, yours.

Control area	Operated by	Your remaining duty
Platform infrastructure and application security	Vendor	Verify the evidence pack covers it and review it annually
Data classification and governance	You	Decide which employee data the platform may process and document it
Identity and access	You	Assign platform roles, approve admin consent, apply conditional access
Endpoint protection	You	Secure the devices your comms team uses to reach the platform

How do you turn missing evidence into decisions?

Most questionnaires die in the follow-up: answers arrive, gaps get noticed, and nothing records what happened next. Close that gap with an evidence-status-owner register. For every questionnaire item, you record five fields, and the register, not anyone's memory, becomes the single source of truth for the review.

Field	What to record
Evidence received	The document or extract that supports the answer, with its date
Status	Received, partial, missing or expired
Accountable owner	One named person on the vendor side and one on yours
Review date	When the item is re-checked, especially for expiring certifications
Decision	Accept the risk, request remediation, or block rollout

If you want a ready-made structure for weighting and scoring the answers once the register is complete, our evaluation framework for choosing an internal communications analytics tool walks through the criteria, questionnaires and demo checks step by step.

What should Communication Insights supply for IT review?

Everything above reduces to a request list you can send to any vendor. For Tryane's Communication Insights, the all-in-one cross-channel analytics platform that connects your email newsletters, SharePoint intranet, Viva Connections and Viva Engage in one central dashboard, ask for the current security evidence pack and check it against the four risk groups from the start of this article.

Identity: the permission matrix for the Microsoft 365 integration, the vendor role model, and the Entra ID authentication documentation.
Hosting and subprocessors: deployment-specific residency, the current subprocessor list, and the Article 28 data processing agreement.
Retention and incidents: the dated retention and deletion policy and the incident response policy with its notification flow.
Certifications: the current reports with their period and scope, not just the badges.

Frequently asked questions

What is a vendor security questionnaire for IC analytics?

It is the checklist your IT and security team sends before approving a third-party analytics tool for internal communication. A useful one groups questions around data flow, identity, security operations and lifecycle risk, and asks every question in a form that names the supporting evidence, its scope and the accountable owner.

Who can grant tenant-wide admin consent in Microsoft Entra ID?

Only users authorized to consent on behalf of the organization, such as the Privileged Role Administrator or the Cloud Application Administrator. Microsoft describes tenant-wide admin consent as a sensitive operation because it gives the application the permissions it requests for the whole organization, so review the requested permissions carefully before granting.^[3]

What stays our responsibility when we deploy a SaaS analytics tool?

Under Microsoft's shared responsibility model, SaaS customers always retain responsibility for their data, configurations and settings, identities and users, and access management, including RBAC, multifactor authentication and conditional access.^[2] The provider secures the underlying cloud infrastructure, but your team configures and monitors the controls in the cloud.

What evidence should a vendor provide for hosting and subprocessors?

Deployment-specific documentation: the hosting location and data residency of your instance, a current subprocessor list with each party's role and location, and a data processing agreement meeting GDPR Article 28 requirements, such as the contract terms the ICO sets out for controller-processor relationships.^[4] A generic trust-centre page is not deployment-specific evidence.

Is a certification badge enough proof of security?

No. Confirm the certification's current scope and dates: which systems and locations the audit covered and the report period. Historical marketing claims are insufficient evidence. Where a vendor cites SOC 2 or ISO 27001, ask for the report or certificate and check that its scope matches the deployment you are buying.

How do we handle questionnaire answers with missing evidence?

Log each item in an evidence-status-owner register: the evidence received, its status (received, partial, missing or expired), the accountable owner on each side and a review date. Unresolved items then become explicit decisions: accept the risk, request remediation or block rollout, keeping identified risks below your accepted internal risk threshold.

What should we request from Tryane when reviewing Communication Insights?

Ask for the current security evidence pack for Communication Insights: the permission matrix for its Microsoft 365 integration, hosting and subprocessor documentation, and the retention and incident handling policies. Route any remaining findings to the responsible owner and set review dates before rollout.

If you are reviewing Communication Insights, request the current security evidence pack before rollout: the permission matrix for the Microsoft 365 integration, the hosting and subprocessor documentation for your deployment, and the retention and incident handling policies. Route any remaining findings to the responsible owner and set review dates, so the questionnaire ends in decisions rather than an open file.

Sources

• learn.microsoft.com

• ico.org.uk