Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we answer a customer's 300-question security questionnaire consistently?

8 decision pointsThe pack behind this answer: Security Questionnaire & Due Diligence Response

Add to board memo

The short answer

Recommendation
Answer once from an approved library, under one named response lead. Use in-date library answers unchanged, have the person who runs the control write or confirm anything else, check the whole draft for promises and sweeping claims, and approve by the kind of answer, never by its author.
Reasoning
The risk is two customers getting different answers to the same question, or an answer describing more than the controls support. A library answer used unchanged keeps every response consistent. Only the person who runs a control knows whether it works for the scope asked. A form is not a contract, so a promise found in an answer goes to Legal and into the contract through the standard schedule. A checklist flag raises the approver an answer needs; the answer may still be right.
Considerations
  • The 2 working days to triage, 5 working days to confirm or write answers, 12 months to reuse a response and 60 days of evidence expiry warning are the pack's defaults. Your own standard may set different ones.
  • A form longer than the largest standard supplier questionnaire, about 60 questions in the pack, is first offered the overview and Public evidence. If the customer still wants its own form, answer it in its own format.
  • In a small team one person may hold two roles. They still cannot approve what they wrote: the next level takes their place, so name it in advance.
  • A request to audit, visit or access your systems goes to Legal. The default offer is report-based assurance.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartA customer sends a 300-question security formStepLog it and name one response leadDecisionIs the sender a customer, or a prospect in a live deal?OutcomeDo not answer yet: confirm the sender or declineDecisionWill they take the overview and evidence, covering every question?OutcomeSend the overview and Public evidenceStepMatch every question to the library and countDecisionIs there time to confirm and write the open answers?StepAgree a later date, with a reason, before startingDecisionIs there a Current library answer for this question?StepThe person who runs the control confirms or writes itStepRun the over-commitment checklist on the whole draftDecisionDoes any check flag an answer nobody has cleared?DecisionCan it be reworded to say only what is true?StepReword it, then run the check againOutcomeSend the promise or claim to LegalDecisionIs any answer new or changed from the library?StepApprove by kind of answer; never the authorDecisionIs each evidence item in date and cleared for this recipient?StepSend what is cleared and say what followsStepSend with the covering statement; keep an exact copyOutcomeLog commitments, follow up, close the request

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 22 steps.

  1. Start

    A customer sends a 300-question security form

    A form this long is normal for a large customer, such as a hospital group. The risk is not the volume. It is that two customers get different answers to the same question, or that an answer describes more than the controls support. The aim is one source of truth that every response draws on.

    In the pack

  2. Step

    Log it and name one response lead

    Log the request the day it arrives, whoever received it, with one named lead from receipt to close and the due date the customer set. Keep the original as received. Nobody replies to the customer's security questions outside this route, including a short email or a call. The pack's default is to triage within 2 working days.

    In the pack

  3. Decision

    Is the sender a customer, or a prospect in a live deal?

    The pack answers customers, and prospects in a live sales opportunity. It declines requests from anyone else and records why. Sales may still send the Public overview and Public evidence. If you cannot tell who the sender is, the cautious branch is to confirm it with the account owner before anything is answered. That fallback is a judgement; the pack does not state it.

    In the pack

  4. Outcome

    Do not answer yet: confirm the sender or decline

    Reply politely, send nothing beyond the Public overview and Public evidence, and record the reason. If the account owner confirms a live opportunity, return to the start of this flow. Answering an unverified sender puts your control descriptions in the hands of someone you owe nothing to.

    In the pack

  5. Decision

    Will they take the overview and evidence, covering every question?

    A form above the largest standard question set in the pack's supplier model, about 60 questions, is first offered the overview and the Public evidence. If the customer accepts and those documents cover every question, you send them and say which questions stay open. If the customer still wants its own form, you answer it in the customer's format without retyping the questions.

    In the pack

  6. Outcome

    Send the overview and Public evidence

    Say which questions the documents leave open, and that the response lead will answer them. The overview is built from library answers, used unchanged, so it stays consistent with every form. Record the decision and its reason in the tracker.

    In the pack

    See also

  7. Step

    Match every question to the library and count

    Count the questions that have a current library answer, a stale one, and none. The pack's example reads 198 of 300 current, 42 stale and 60 without an answer. Report reuse as a count, never as a share. If the same customer or standard form was answered in the last 12 months and those answers are still current, reuse that response and tell the customer what changed.

    In the pack

  8. Decision

    Is there time to confirm and write the open answers?

    The pack's default is at least 5 working days when answers must be confirmed or written. If fewer remain, or you do not know, agree a later date with the customer before work starts. A due date that has already passed is raised with the customer the same day. Never let a request lapse.

    In the pack

  9. Step

    Agree a later date, with a reason, before starting

    The account owner agrees the new date with the customer and the response lead records it. Plan the approvals now from the counts: name the topic owners who must confirm the stale answers and the person who will approve the new ones.

    In the pack

  10. Decision

    Is there a Current library answer for this question?

    Current means approved, within its review date and with evidence in date. Use it unchanged and do not edit it inside the customer's form. If it is stale, withdrawn or missing, or you do not know, it goes to the owner. An answer past its review date is not sent until the owner has confirmed or changed it.

    In the pack

  11. Step

    The person who runs the control confirms or writes it

    The topic owner writes or confirms the answer, states what it covers (the whole company, a named service, a named site, a supplier's service, a written policy only or a dated plan) and cites evidence from the index or marks it a statement only. Nobody confirms an answer about a control they do not run. AI answers come from the AI inventory. A drafting tool may suggest only from the library and only if approved for the data it sees.

    In the pack

  12. Step

    Run the over-commitment checklist on the whole draft

    Eight checks look for absolute words, time promises, claims about everything, certification claims, promise verbs, audit rights, liability terms and plans worded as present fact. Run it on every response before it goes out. A flag does not mean the answer is wrong. It means the answer needs a higher approver than its kind alone would.

    In the pack

  13. Decision

    Does any check flag an answer nobody has cleared?

    In the pack's example, five first drafts were stopped: a certificate claim that belonged to the hosting provider, 'all critical suppliers', a 12-hour notice promise, 'every six months' for testing and 'audit at any time'. Each was replaced by a library answer or a pointer to the standard schedule. A flag the approver has cleared in writing stays cleared only for the same words, so a cleared answer does not go round again.

    In the pack

  14. Decision

    Can it be reworded to say only what is true?

    Fix the wording where the fix is plain: drop the absolute word, name the service, replace a period with a pointer to the standard schedule, describe what is done today. If the answer is a real promise, a right of audit, a liability or a claim of certification, rewording only hides it. Treat it as a commitment or a claim. When you cannot tell, take that cautious branch.

    In the pack

  15. Step

    Reword it, then run the check again

    A reworded answer is an adapted answer. It goes back through the checklist, because new words can raise a new flag. The corrected wording is entered in the library first, so the next form gets the same answer.

    In the pack

  16. Decision

    Is any answer new or changed from the library?

    A Current library answer used unchanged is released by the response lead and needs no new approval. An adapted answer is confirmed by the topic owner. A new answer is approved by the head of information security and then added to the library. Both go into the library before use.

    In the pack

  17. Step

    Approve by kind of answer; never the author

    Record each approval with name, role and date, and have the approver clear each flag in writing. Nobody approves an answer they wrote: the next level takes their place, so a topic owner's answer goes to the head of information security, and the head's own goes to the executive decision-maker. The account owner writes no security answer. Do not send part of a response without telling the customer which answers follow.

    In the pack

    See also

  18. Decision

    Is each evidence item in date and cleared for this recipient?

    Release evidence by its sharing tier on the day you send it. Public items go with the lead's release. Items under a non-disclosure agreement need one in force for the recipient, and the head of information security releases them. A summary-only item goes as its approved summary. Expired items and the supplier's documents without the supplier's permission are not sent. Treating unknown as no is a judgement; the pack does not state it.

    In the pack

    See also

  19. Step

    Send what is cleared and say what follows

    Offer the Public items and any approved summaries now. Ask Legal for the non-disclosure agreement where one is needed, and renew or withdraw expired items; answers that cite them are held until then. Tell the customer which evidence will follow. Do not promise a date the schedule does not support.

    In the pack

  20. Step

    Send with the covering statement; keep an exact copy

    Every response opens with the same covering statement, confirmed once by Legal: the answers describe the organisation on a date, for the scope each states, and a commitment is made only in the agreement. The account owner sends only what the lead released, through the customer's channel or an encrypted route. Keep the response as sent, its approvals and the evidence versions cited.

    In the pack

  21. Outcome

    Log commitments, follow up, close the request

    Log every commitment made in or around the response with an owner, a due date and what supports it, and chase the open ones. Report counts each month: requests answered on time, answers reused, answers past their review date, evidence nearing expiry and commitments open. Never one score. If an answer later proves wrong, correct it by the pack's correction route.

    In the pack

    See also

Practical checklist

  1. Log the request the day it arrives, name one response lead and keep the original as received.
  2. Confirm the sender is a customer or a prospect in a live deal. Decline anyone else and record why.
  3. For a long form, offer the overview and Public evidence first. If the customer still wants its form, count the current, stale and missing library answers.
  4. Agree a later date before work starts if too few working days remain to confirm or write answers.
  5. Use in-date library answers unchanged. Send the rest to the topic owner who runs the control, with scope and evidence stated.
  6. Run the over-commitment checklist on the whole draft. Reword plain fixes, and send real promises and certification claims to Legal.
  7. Approve each answer by its kind, never by its author, and release evidence by its sharing tier and expiry date.
  8. Send with the covering statement, keep an exact copy, and log every commitment with an owner and a due date.

Evidence to have ready

  • The tracker entry: one named response lead, the received and due dates, and the triage decision with its reason (QG-03, IN-09).
  • The response exactly as sent, with its covering statement, its approvals and the evidence versions cited (QG-16).
  • The completed over-commitment checklist, with each flag cleared in writing by the approver its kind sets (QG-11).
  • The commitments log, with each commitment's owner, due date and what supports it (QG-17).
  • The evidence release record, and the non-disclosure agreement in force on the day where the sharing tier needs one.

Assumptions

  • You answer as a supplier, and the sender is a customer or a prospect in a live sales opportunity. The questionnaires you send to your own suppliers are a different job.
  • You have, or will build, a library of approved answers and an index of evidence. Without them, every answer is a new answer and needs the higher approval.
  • The figures shown are the defaults in the CISO Times pack: 2 working days to triage, 5 working days to confirm or write answers, 12 months to reuse a response and 60 days of evidence expiry warning. Your own standard may set different ones.
  • The roles are as the pack names them: a response lead, topic owners, an account owner, the head of information security and Legal. A small organisation may combine some of them, but nobody approves an answer they wrote.

Not covered here