How do we build and keep a library of security answers we can reuse?

Start

Customers keep asking the same security questions

Every answer you give a customer is a statement your organisation is held to. A customer reads it as a description of what you do and relies on it when it buys. Answering from the last form or from memory repeats old mistakes. A library lets you answer once, from an approved source, with evidence behind it.

• Then: Group the questions under ten topics, each with one owner

Step

Group the questions under ten topics, each with one owner

The pack uses ten topics: Governance, Access, Data protection, Incident notice, Resilience, Development, Suppliers, AI, Privacy and Physical. Each topic has a named owner, the person who runs the control. The review intervals are the pack's defaults: 12 months, and 6 months for incident notice and AI. Change an interval only if your own method says so.

• Then: Start with the questions customers ask most

Step

Start with the questions customers ask most

Judgement call. The pack lets a small organisation begin with the questions it is asked most and grow the library from the forms it receives, leaving other topics empty until a customer asks. A short library you keep in date is worth more than a long one that goes stale. Take the questions from forms you already hold and answer each once.

• Then: List the evidence you can show in an evidence index first

Step

List the evidence you can show in an evidence index first

An answer that states a control, a test or an assurance must cite evidence or say it is a statement only. So list the documents you could show a customer first: certificates, reports, test summaries, policy extracts, attestations. Give each an issuer, a scope, an expiry date and a sharing tier. The library copies from this index, which stays the master.

• Then: Write one customer-ready answer per question

Step

Write one customer-ready answer per question

Write in the first person plural with no internal document or rule IDs in the words. The topic owner writes or confirms each answer. A drafting tool may suggest wording only from the library, and only if it is approved for the data it sees. What it drafts is a new or adapted answer and takes its approval. A questionnaire never goes into a tool that is not approved for Confidential data.

• Then: Does the evidence support the scope you want to claim?

Decision

Does the evidence support the scope you want to claim?

Every answer carries one scope of claim: whole company, a named service, a named site, a named system or tool list, a supplier's service, a written policy only, or a plan with a date. The scope must be no wider than the evidence supports. A control at one service is a control at that service. A written policy shows what you require, not that every case meets it. If you are not sure, take the narrower branch.

• Yes: Do the words trip an over-commitment check?
• No, or not known: Narrow the scope, state a dated plan, or mark it statement only

Step

Narrow the scope, state a dated plan, or mark it statement only

Name the service or site the control really covers. If the control is planned, give it the plan scope with its date and never word it as present. A supplier's control is about the supplier's service, so say whose it is. With no evidence at all, the entry says it is a statement only. An answer with no scope, or with a scope its evidence does not support, is not used.

• Then: Do the words trip an over-commitment check?

Decision

Do the words trip an over-commitment check?

The checklist runs eight checks on the wording: absolute words, time and frequency promises, claims about everything, certification and compliance claims, promise verbs, audit and access rights, liability and remedy, and plans worded as present. A flag does not mean the answer is wrong. It means someone with the right authority reads it first. If you have not run the checks, answer yes.

• Yes, or not known: Reword it, or send the flag to the approver it sets
• No: Is the approver also the person who wrote the answer?

Step

Reword it, or send the flag to the approver it sets

Describe what is done today in the present tense, or point to the standard commitments schedule instead of stating a period. A check raises the answer to a kind, and the kind sets who clears the flag in writing. A promise, a right of audit, a liability or a remedy goes to Legal and the Head of Information Security, as does a claim of certification or compliance. Absolute words, claims about everything and a plan worded as present make it an adapted answer, which the topic owner confirms. The Data Protection Officer joins where a commitment or claim concerns personal data. A cleared flag stays on the library entry while the words stay the same.

• Then: Is the approver also the person who wrote the answer?

Decision

Is the approver also the person who wrote the answer?

Nobody approves an answer they wrote. The kind of answer sets the approver: a new answer needs the topic owner and the Head of Information Security, an adapted answer needs the topic owner, and a promise or a claim needs Legal and the Head of Information Security. If the author is one of those people, the next level takes their place. If you are not sure who wrote it, answer yes.

• Yes, or not known: Name the next level to approve in their place
• No: Enter it as Approved with owner, scope, evidence and review date

Step

Name the next level to approve in their place

The pack names the next level for each author. For example the questionnaire response lead's answers go to the Head of Information Security, and the Head of Information Security's go to the executive decision-maker. A small team names its next level in advance, usually the managing director or an outside adviser under a signed non-disclosure agreement, and keeps a short written record of each approval. The response lead records who was replaced.

• Then: Enter it as Approved with owner, scope, evidence and review date

Step

Enter it as Approved with owner, scope, evidence and review date

A new answer is a Draft until its approver approves it. Then set it to Approved and enter the day the owner last reviewed it. The review date follows from the topic's interval. The entry now holds the answer, its scope, its evidence IDs, its owner and any cleared flags, so the next person need not raise them again.

• Then: Answer forms from the library and change the library first

Step

Answer forms from the library and change the library first

For each question in a customer's form, find the matching library answer and copy it unchanged. If the words must change, change the library entry first, with its owner's approval, and then use it. Never edit an answer inside the customer's form. A question with no match goes to the topic owner and joins the library once approved. Do not send the workbook itself, because its basis column is internal.

• Then: Can the answer go out as it stands today?

Decision

Can the answer go out as it stands today?

The library works out a state from the dates and the evidence. Current, Review due and Evidence expiring may go out, and the last two prompt a review or a renewal. Withdrawn, Not approved, No scope, No evidence reference, Evidence expired and Stale may not. If you cannot tell the state, answer no. The response lead reports the count past review and the evidence expiring as counts, never a score.

• Yes: Send it as it stands, then review or renew if prompted
• No, or not known: Is the answer still true for the scope it claims?

Outcome

Send it as it stands, then review or renew if prompted

Send the answer word for word. If its state is Review due or Evidence expiring, say when the evidence expires where that applies, and schedule the owner's review or the evidence renewal now, so that the answer is not Stale or expired by the next request.

Decision

Is the answer still true for the scope it claims?

The topic owner checks the answer against what happens on a bad day. If the answer differs from the practice, the answer follows the practice. A Stale answer can be confirmed or changed. For Evidence expired, the owner either renews the evidence or changes the answer. Not approved, No scope, No evidence reference and Withdrawn are faults in the entry, not matters to confirm: take the no branch. If the owner cannot say, take the no branch.

• Yes: Owner confirms or renews, with a new review date and no other change
• No, or not known: Did an earlier response already send the wrong answer?

Outcome

Owner confirms or renews, with a new review date and no other change

For a Stale answer, a confirmation changes the review date and nothing else. If any word needs to change, it is a change, not a confirmation. For Evidence expired, renew the evidence in the index first. Once the owner has done so, the answer can be Current again and the next request can use it.

Decision

Did an earlier response already send the wrong answer?

Search the tracker and the stored responses for every response that used the answer. If a customer has the old text, withdrawing it from the library is not enough. If you cannot search the old responses, answer yes.

• Yes, or not known: Withdraw it and correct the customer by the correction route
• No: Change the entry and put it through approval again

Outcome

Withdraw it and correct the customer by the correction route

Withdraw the answer at once and keep it in the library with the reason, so the affected responses can be found. The pack rates a correction minor or material. For a material one, Legal and the Head of Information Security approve a written correction, and the account owner sends it within the pack's correction window. A control that does not work, or exposed personal data, also goes to the incident route. Take it to the correction route.

Step

Change the entry and put it through approval again

Rewrite the answer as the owner states it. A changed answer is checked for flags again and approved by the approver its kind sets. For a Withdrawn answer, the changed wording is a new entry. No earlier response used the wrong text, so no customer notice is needed.

• Then: Do the words trip an over-commitment check? (back to an earlier step)