Are you offering a cloud-based product?

This question is asking whether your company offers a product that is hosted in the cloud and delivered to customers via the internet (often called Software as a Service or SaaS). Why it's being asked: Cloud-based products introduce specific security considerations that on-premises software doesn't have. When you host a product in the cloud, you're responsible for securing the application, managing customer data in a multi-tenant environment, ensuring proper access controls, and maintaining the infrastructure. The assessment wants to determine if cloud-specific security questions are relevant to your offering. The guidance clarifies that if you're only offering a service (like consulting) or if your product is installed on customer premises rather than hosted in your cloud environment, you should answer 'no'. How to best answer it: Be straightforward about your delivery model. If your product is hosted in AWS, Azure, Google Cloud, or your own data centers and accessed by customers over the internet through a web browser or API, answer 'yes'. If you sell software that customers install on their own systems or if you provide purely professional services without a technology component that you host, answer 'no'.