Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we decide who approves our answers to a customer's security questionnaire before we send them?

8 decision pointsThe pack behind this answer: Security Questionnaire & Due Diligence Response

Add to board memo

The short answer

Recommendation
Let the kind of answer set the approver. The response lead releases a Current library answer used unchanged, the topic owner confirms an adapted answer, the Head of Information Security approves a new one, and Legal with the Head of Information Security approve any promise or claim.
Reasoning
An answer is a statement the organisation is held to, and the customer may point to it later, so each answer is approved by someone with the authority its kind needs before anything is sent (QG-08). The over-commitment checklist flags wording that turns an answer into a promise or a claim; a flag means a higher approver, not a wrong answer. A form is not a contract, so a promise is made only through the standard schedule and its ladder (QG-09).
Considerations
  • The Data Protection Officer, or the privacy lead where none is appointed, also approves a commitment or claim that involves personal data.
  • Nobody approves an answer they wrote. The Head of Information Security replaces the response lead or topic owner, Legal replaces the Data Protection Officer, and the executive decision-maker replaces the Head of Information Security or Legal.
  • Anything beyond the schedule's fallback wording is an exception, rated on the risk bands and approved with Legal added. A Critical one needs Legal and the board, a board risk committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board.
  • These roles are the pack's defaults. In a small team one person may hold several roles but still cannot approve their own answer, so name the next level in advance.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartAn answer is drafted for a customer's questionnaireStepMatch it to the library and run the checklistDecisionIs it a Current library answer, with its wording unchanged?OutcomeResponse lead releases it; no new approvalDecisionDoes it promise something or claim certification or compliance?StepReword it plainly and re-run the checkDecisionDoes a promise or claim flag still stand?DecisionDoes it ask for a term beyond the standard schedule?OutcomeTake it off the form and route it as an exceptionDecisionDoes it concern personal data?StepLegal, the Head of InfoSec and the DPO approveStepLegal and the Head of Information Security approveDecisionDoes a library answer stand behind it?StepTopic owner confirms it; update the library firstStepTopic owner writes it; Head of InfoSec approves itDecisionDid any named approver write or draft part of the answer?StepThe next level approves in their placeStepRecord each approval and clear each flag in writingDecisionIs every flag cleared and every approval recorded?OutcomeResponse lead releases the answer into the responseOutcomeHold the answer; do not send it

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 21 steps.

  1. Start

    An answer is drafted for a customer's questionnaire

    An answer is a statement the organisation is held to. The customer relies on it when it buys and may point to it later. So each answer is approved by someone with the authority its kind needs, before anything is sent. Work answer by answer: one response often holds all five kinds.

    In the pack

  2. Step

    Match it to the library and run the checklist

    Find the library answer behind the question, if any, and run the whole draft through the response quality and over-commitment checklist. The checklist has eight checks. A flag does not mean the answer is wrong. It means the answer needs a higher approver than its kind alone would.

    In the pack

  3. Decision

    Is it a Current library answer, with its wording unchanged?

    Current means approved, in date, with its evidence in date. Withdrawn, Not approved, No scope, No evidence reference, Evidence expired and Stale answers are not sent as they stand. Review due and Evidence expiring answers may be sent, with the review or renewal started. Changing one word makes it a new check. A flag the approver cleared earlier stays cleared only for the same words. Judgement: if you cannot tell whether the words changed, answer no.

    In the pack

  4. Outcome

    Response lead releases it; no new approval

    The library answer was approved when it was entered, so using it unchanged needs no new approval. The questionnaire response lead releases it and wrote none of it. The lead releases every response whatever kinds it holds, and where an answer in it needs a higher approver, that approver decides.

    In the pack

  5. Decision

    Does it promise something or claim certification or compliance?

    Look for a date, an action, a right of audit or access, a cost or liability, or a statement that the organisation is certified, compliant or aligned. These are the checks for time and frequency, promise verbs, audit rights, liability and certification claims. Judgement: if you are unsure whether wording is a promise, answer yes.

    In the pack

  6. Step

    Reword it plainly and re-run the check

    Fix the wording first where the fix is plain: point to the period in the standard schedule instead of stating one, describe what is done today in the present tense, name the document, its scope, issuer and dates and say whose it is. A reworded answer that raises no flag falls back to the adapted or new route. Never state a new period in a form.

    In the pack

  7. Decision

    Does a promise or claim flag still stand?

    If the re-run still flags the answer, it needs Legal and the Head of Information Security whatever else is true. If the flag has gone, the answer is a plain statement and the next question is whether the library already holds it. Not known counts as yes.

    In the pack

  8. Decision

    Does it ask for a term beyond the standard schedule?

    A form is not a contract. Promises are made through the standard security commitments schedule and its ladder: the standard wording, the fallback wording, and an exception. The account owner offers the first two. Anything beyond the fallback is a departure from the standard. Judgement: if you cannot tell whether the schedule covers it, treat it as beyond.

    In the pack

  9. Outcome

    Take it off the form and route it as an exception

    Do not agree it in the questionnaire. Rate the departure on the risk management bands and approve it as an exception under the exception standard, with Legal added. The owner of the risk is never among the approvers, and the approvers rise with the band. Record the exception before the customer is told yes. Take the question to your own exception process.

    In the pack

    See also

  10. Decision

    Does it concern personal data?

    Personal data covers processor terms, transfers, data subject requests and the like. The Data Protection Officer, or the privacy lead where none is appointed, approves as well as Legal and the Head of Information Security. Judgement: if you cannot tell, answer yes, because adding one approver costs less than missing one.

    In the pack

  11. Step

    Legal, the Head of InfoSec and the DPO approve

    Legal approves the commitment or the claim and confirms the wording of any certificate or compliance statement. The Head of Information Security confirms the control behind it. The Data Protection Officer approves as well. Only the wording Legal confirms is kept for reuse, and a commitment belongs in the contract, not the library.

    In the pack

  12. Step

    Legal and the Head of Information Security approve

    Legal approves the commitment or the claim and confirms the wording of any certificate or compliance statement. The Head of Information Security confirms the control behind it. A supplier's certificate is never presented as the organisation's own. Only the wording Legal confirms is kept for reuse.

    In the pack

  13. Decision

    Does a library answer stand behind it?

    If a library answer exists and only the words, the scope or a plan has changed, it is an adapted answer. If nothing in the library matches the question, it is a new answer, which needs the higher approver. If you cannot tell whether the library answer still fits, answer no.

    In the pack

  14. Step

    Topic owner confirms it; update the library first

    The topic owner is the person who runs the control. Nobody confirms an answer about a control they do not run. Change the library entry, take the owner's confirmation, then use it. Do not edit an answer inside the customer's form. Absolute words, claims about everything and plans stated as the present all land here.

    In the pack

  15. Step

    Topic owner writes it; Head of InfoSec approves it

    A new answer has no approved source behind it. The topic owner writes it and states what it covers and what evidence supports it. The Head of Information Security approves it. It is added to the library after approval, so the next request reuses it.

    In the pack

  16. Decision

    Did any named approver write or draft part of the answer?

    Nobody approves an answer they wrote. The next level takes their place, and the response lead records who was replaced. Replacements: the response lead and the topic owner by the Head of Information Security; the Data Protection Officer by Legal; the Head of Information Security and Legal by the executive decision-maker. Not known counts as yes.

    In the pack

  17. Step

    The next level approves in their place

    In a small team one person may be both response lead and Head of Information Security. That person still cannot approve what they wrote. Name the next level in advance: usually the managing director, or an adviser under a non-disclosure agreement. The executive decision-maker is whoever your governance sets, not one body for every organisation.

    In the pack

  18. Step

    Record each approval and clear each flag in writing

    The response lead records each approval against the answer: name, role and date. The approver the kind of answer sets clears each flag in writing. A cleared flag holds only for the same words. Take the record in your own tracker or response file.

    In the pack

  19. Decision

    Is every flag cleared and every approval recorded?

    An answer that needs Legal waits for Legal. If any flag is open or any approval is missing, the answer is not ready. Do not send part of a response while a flagged answer is open without telling the customer which answers follow.

    In the pack

  20. Outcome

    Response lead releases the answer into the response

    The answer is approved at the level its kind sets. The questionnaire response lead releases the whole response, and the account owner sends only what the lead released. Next, check the sharing tier of each document you attach before it goes.

    In the pack

    See also

  21. Outcome

    Hold the answer; do not send it

    Do not send an answer that is not fully approved. Get the missing approval or clear the flag, or hold that answer back and tell the customer which answers follow. The account owner agrees any new date with the customer.

    In the pack

Practical checklist

  1. Match each answer to the library and run the whole draft through the over-commitment checklist.
  2. Use a library answer unchanged only if it is Current, Review due or Evidence expiring, and start the review or renewal for the last two.
  3. Change an adapted answer in the library first and take the topic owner's confirmation. Do not edit it inside the customer's form.
  4. Reword plain fixes, such as pointing to the schedule's period instead of stating one, then re-run the check.
  5. Send an answer that still promises or claims something to Legal and the Head of Information Security, adding the Data Protection Officer for personal data.
  6. Take any term beyond the standard schedule off the form and route it through your exception process.
  7. Have the topic owner write each new answer and the Head of Information Security approve it, replacing any approver who wrote part of it.
  8. Record each approval and cleared flag, then let the response lead release the response.

Evidence to have ready

  • The completed over-commitment checklist, with each flag cleared in writing by the approver the kind of answer sets (QG-11).
  • An approval record for every answer that is not a library answer: the kind of answer, and the approver's name, role and date.
  • Where an author was an approver, who was replaced and who approved instead.
  • Legal's decision on each promise found, and Legal's written confirmation of any certification or compliance wording.
  • Any exception for a departure from the standard schedule, recorded before the customer was told yes.

Assumptions

  • You keep, or are building, a library of approved answers with a named owner for each topic. Without one, every answer counts as new.
  • The roles and approvers are the defaults in the CISO Times questionnaire pack. Your own standard may set others. In a small team one person may hold several roles, but still cannot approve their own answer.
  • You have access to Legal, in-house or external, and you know who your executive decision-maker is under your own governance.

Not covered here