What the report is
An ISAE 3000 report is issued by an auditing firm under an international assurance standard. You describe your system and its controls; the auditor tests whether the controls are designed suitably and, in a Type II report, whether they operated effectively over a period, usually a year. The report contains the description, the controls, the auditor's tests and results, and any exceptions. Customers read the exceptions first.
Danish and other Northern European customers, and their auditors, ask for it because their own auditors want to rely on it. Financial entities under DORA ask for it as the standard form of independent assurance on an ICT provider.
What a questionnaire asks around it
If you have a report: the period it covers, the scope (which services, which locations), the exceptions and how you addressed them, the sub-service organisations carved out (usually your hosting provider, whose own report they will ask for), and whether the next report is planned. The questionnaire itself is then short: the rows the report does not cover, and anything since the period ended.
If you do not: the questionnaire is a full security questionnaire, and it often ends with "when do you plan to obtain an assurance report". Have an honest answer. Many customers accept a vendor without a report when the answers are specific and the plan is credible.
Preparing for a first report
The controls the auditor tests are the ones you describe, so the preparation is deciding which controls you can show operating: access reviews with records, change management with approvals, incident handling with tickets, backup tests with logs, training with completion records. The evidence you have been attaching to questionnaires is the evidence the auditor will test. A team that has kept its answer library with dates and evidence walks into the first report period already organised.
In Responsemate
Keep one approved answer per control in the knowledge base, with its evidence and its date, and the controls you have never written an answer for are the ones to add before an assurance engagement. When the report exists, it becomes evidence in the knowledge base with an expiry at the end of its period, and the rows that refer to it are drafted from it. Knowledge in Responsemate.
Questions people ask
What is the difference between ISAE 3000 and ISAE 3402?
ISAE 3402 is the standard for reports on controls relevant to a customer's financial reporting, the European counterpart of SOC 1. ISAE 3000 covers assurance on anything else, and is the standard used for reports on security, availability and privacy controls, the European counterpart of SOC 2. A "3000" report is what a security questionnaire wants.
Is an ISAE 3000 report the same as ISO 27001?
No. ISO 27001 certifies that your management system meets the standard. An ISAE 3000 report is an auditor's opinion on whether specific controls you described operated effectively over a period, with a test of each. Customers who audit their suppliers prefer the report, because it shows the tests.