Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we decide whether to answer a questionnaire in full, point to a certificate, or decline?

7 decision pointsThe pack behind this answer: Security Questionnaire & Due Diligence Response

Add to board memo

The short answer

Recommendation
Triage every request before anyone drafts. Decline senders who are neither a customer nor a prospect in a live sale. Otherwise offer the overview and in-date evidence first, point to them only if the customer accepts and they cover every question, and answer in full whatever they leave open.
Reasoning
A form is a statement you are held to, so the first decision is how much of it to answer. The overview and the evidence answer the common questions once, from approved sources. They replace the form only when the customer accepts them and they cover every question, and a document supports an answer only for the scope it names. Audit, visit and access requests, contract terms, promises and compliance claims are not ordinary answers. They go to Legal, joined by the Head of Information Security for terms, promises and claims, and the default offer for an audit is report-based assurance.
Considerations
  • The figures are the pack's defaults: triage within 2 working days, a form above about 60 questions offered the overview first, and a later date agreed when fewer than 5 working days remain. Your own standard may set others.
  • A long form is a reason to offer the overview first. It is not a reason to refuse the form.
  • A supplier's certificate covers the supplier's service. Describe it as theirs and share it only as their terms allow.
  • Items under a non-disclosure agreement need one in force that covers the recipient on the day. Ask Legal whether an agreement with the customer's lawyers covers its security team.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA customer sends a security questionnaireStepLog it and name one response leadDecisionIs the sender a customer or a prospect in a live sale?OutcomeDecline politely, send nothing, record whyDecisionDoes it ask to audit, visit, enter systems or set terms?StepSend that part to Legal; offer report-based assuranceStepCount answers: Current, stale, and none in the libraryStepOffer the overview and the evidence before the formDecisionWill the customer take them in place of the form?DecisionDoes each document's scope cover the service they asked about?StepLeave out documents that do not cover the serviceDecisionIs each one in date and releasable to this recipient?StepSend Public items only; ask Legal for the NDADecisionDo the documents answer every question on the form?OutcomePoint to the overview and the evidenceStepSend the documents and list the questions they leave openStepAnswer in full: agree the date and plan the approvalsDecisionDoes any question ask us to promise something or claim certification?StepSend promises and claims to Legal and the security headOutcomeDraft from the library, approve by kind, then release

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 20 steps.

  1. Start

    A customer sends a security questionnaire

    The form is a request to describe the organisation, and what you write is a statement you are held to. Before anyone drafts, decide how much of the form to answer. Three decisions exist: answer in full, point to a certificate or the overview, or decline. Record which one you chose and why.

    In the pack

  2. Step

    Log it and name one response lead

    Log every request the day it arrives, whoever receives it, with one named response lead until it closes. Triage within the pack's default of 2 working days. Nobody in sales or on the account team answers a security question outside this route, including a short reply by email or on a call.

    In the pack

  3. Decision

    Is the sender a customer or a prospect in a live sale?

    Answer a customer, or a prospect in a live sales opportunity. A researcher, a competitor or a cold survey is neither. If you do not know, ask the account owner to confirm the relationship before anything leaves. Judgement: until it is confirmed, this flow takes the cautious branch and sends nothing beyond Public items.

    In the pack

  4. Outcome

    Decline politely, send nothing, record why

    Reply courteously and send no answers and no evidence. Record the reason in the tracker. Sales may still send the Public overview and the Public evidence to anyone, because those items need no further agreement.

    In the pack

  5. Step

    Count answers: Current, stale, and none in the library

    Count the questions that have a Current library answer, a stale one and none. Write them as counts, for example 198 of 300, never as a share of the form. Stale answers need their topic owner to confirm them before use. Questions with no answer need a new one written and approved.

    In the pack

  6. Step

    Offer the overview and the evidence before the form

    Prefer the overview and the evidence pack to a long form. A form above about 60 questions is longer than the largest standard set in the supplier assurance pack, so it is a reason to offer the overview first. It is not a reason to refuse the form. If the customer still wants the form, you answer it.

    In the pack

  7. Decision

    Will the customer take them in place of the form?

    Ask, do not assume. The pack lets you point to the overview and evidence only when the customer accepts them and they cover every question. If the customer says no, or has not replied by the time the work must start, answer in full.

    In the pack

  8. Decision

    Does each document's scope cover the service they asked about?

    A certificate names a scope: a service, sites and a legal entity. Check that it names the ones the customer uses. A hosting provider's certificate covers the provider's service, not yours, and is described as theirs. If you do not know the scope, answer no.

    In the pack

  9. Step

    Leave out documents that do not cover the service

    A document with the wrong scope cannot support the answer. Leave it out, or send it labelled with the scope it has. Never let a supplier's certificate read as your own, and send it only as that supplier's terms allow.

    In the pack

  10. Decision

    Is each one in date and releasable to this recipient?

    Check the evidence index on the day you send. An expired or withdrawn item is not sent. Public items go to anyone. Items under a non-disclosure agreement need one in force that covers the recipient. Summary-only items go as their approved summary. If any is unknown, answer no.

    In the pack

  11. Step

    Send Public items only; ask Legal for the NDA

    Offer the Public items and any approved summary. Send the request for a non-disclosure agreement to Legal, who also confirm whether an agreement with the customer's lawyers covers its security team. Renew or leave out anything past its expiry.

    In the pack

  12. Decision

    Do the documents answer every question on the form?

    Compare the documents you can send with the questions. Cover means each question has an answer in them. Check each question rather than assuming the overview covers it, and remember that an evidence document is described only as its own title, scope, issuer and dates state it. If any question is left open, answer no.

    In the pack

  13. Outcome

    Point to the overview and the evidence

    Send the overview and the in-date evidence the recipient may have, through the response lead, described by title, scope, issuer and dates. Add the covering statement. Tell the customer the response lead will answer anything the documents leave open. Log the release in the tracker.

    In the pack

  14. Step

    Send the documents and list the questions they leave open

    This is the pack's route for documents that do not cover everything: send the overview and the Public or releasable evidence, and say which questions they leave open. Judgement: the pack does not say how to treat a document that covers only part of a form, so this flow then answers the open questions in full, with the same claim checks.

    In the pack

  15. Step

    Answer in full: agree the date and plan the approvals

    Answering in full is the usual case, and here it also covers the questions the documents leave open. Agree the due date with the customer. With fewer than 5 working days and answers to confirm or write, agree a later one before work starts. Plan approvals from the counts. A question about a system the customer does not use is answered by saying so.

    In the pack

  16. Decision

    Does any question ask us to promise something or claim certification?

    A form is not a contract. Promises (a time, a right of audit, a liability) and statements that you are certified, compliant or aligned are not ordinary answers. Say certified only when the index holds a current document for that scope and Legal confirms the wording. If you are unsure of a phrase, answer yes.

    In the pack

  17. Step

    Send promises and claims to Legal and the security head

    Legal and the Head of Information Security approve a contractual commitment or a legal or regulatory claim, with the Data Protection Officer where personal data is involved. Offer the standard schedule instead of a promise in the form. Nobody approves a statement they wrote.

    In the pack

  18. Outcome

    Draft from the library, approve by kind, then release

    Draft from the library and change the library first, never inside the customer's form. Run the response check on the whole response. The approver follows the kind of answer, from the response lead releasing a library answer to Legal for a claim. Keep an exact copy as sent with its approvals.

    In the pack

    See also

Practical checklist

  1. Log the request the day it arrives and name one response lead.
  2. Decline, send nothing and record why if the sender is neither a customer nor a prospect in a live sale.
  3. Send any audit, visit or access request to Legal, and contract terms to Legal and the Head of Information Security.
  4. Count the questions with a Current library answer, a stale one and none, as counts.
  5. Offer the overview and the evidence before the form, and ask whether the customer will take them.
  6. Check each document's scope, expiry date and sharing tier for this recipient on the day you send.
  7. Point to the documents only if they cover every question, and say which questions they leave open.
  8. Answer the rest in full: agree the date, send promises and claims to Legal and the Head of Information Security, and approve each answer by its kind.

Evidence to have ready

  • The tracker entry: received date, response lead, triage decision and its reason, and the three counts.
  • For a declined request, the recorded reason.
  • The evidence released, with the recipient and the day, and the non-disclosure agreement in force where a tier needs one.
  • The exact copy of the response as sent, with its covering statement and the approval for each answer that is not a Current library answer.
  • Legal's decision on any audit, access or terms request, and the approvals for any promise or claim.

Assumptions

  • You have, or will write, a customer-facing overview and a list of the evidence you can share, with each item's scope, dates and who may receive it.
  • The figures shown (about 60 questions, 5 working days, 2 working days to triage) are the pack's defaults. Your own standard may set different ones.
  • One person leads the response, and a separate person approves answers they did not write. The top approver depends on how you are governed: the board or its delegated committee, the management board in a two-tier structure, or executive management where there is no board.

Not covered here