How do we write a customer-facing security overview that answers most questionnaires before they arrive?

Start

Customers keep sending forms with the same questions

A customer-facing overview answers the common questions once, in words the customer can read before the form arrives. It cannot answer every question. Some depend on the date or on the customer's own contract, and those are answered for each request. Every statement in it is a statement the organisation is held to.

• Then: Name the services and the date the overview covers

Step

Name the services and the date the overview covers

Name only the services the statements describe, and date the document. A statement about the online ordering service is not a statement about the warehouses. Do not say whether the organisation is an essential, important or financial entity unless Legal confirms it.

• Then: Is there a library of approved answers to draw from?

Decision

Is there a library of approved answers to draw from?

Each statement in the overview is a library answer, used unchanged. Without approved answers there is nothing to take from, and writing the prose first creates statements nobody owns. If you do not know, answer no.

• No, or not known: Build the answer library first, then return
• Yes: Match each section to one library topic

Outcome

Build the answer library first, then return

Start with the questions customers ask most, a few answers for each topic, each with an owner, a scope of claim and evidence or the words Statement only. The overview comes after, as a view of the answers that may go out as they stand.

Step

Match each section to one library topic

Ten of the 14 sections draw on one library topic each: governance, access, data protection, incident notice, resilience, development, suppliers, AI, privacy and physical. The other four are fixed text: about the document, who we are, the evidence you can share, and what the document is not.

• Then: Does the section have an answer that may go out as it stands?

Decision

Does the section have an answer that may go out as it stands?

An answer may go out as it stands when its state is Current, Review due or Evidence expiring (QG-05). An answer with evidence expiring says when it expires. A draft, stale or withdrawn answer is not used. The overview names only the evidence each answer's sharing tier allows, which the evidence check below confirms. If you do not know, answer no.

• No, or not known: Leave the section out and answer it for each request
• Yes: Copy each answer unchanged and show what it covers

Step

Leave the section out and answer it for each request

A section with no answer that may go out as it stands is left out of the issued overview. Ten sound sections are worth more than fourteen that include a statement nobody can support. Renew or approve the answer in the library, and add the section at the next issue.

• Then: Copy each answer unchanged and show what it covers

Step

Copy each answer unchanged and show what it covers

Do not edit a statement in the overview. If it is wrong or out of date, change the library answer first with its owner's approval, then the overview. Each statement carries its scope of claim, so a customer knows how far to rely on it. The statement that the overview describes the organisation as at its date is used as the template gives it, with Legal confirming its wording.

• Then: Does any sentence give a period, objective, audit right or liability?

Decision

Does any sentence give a period, objective, audit right or liability?

The overview describes and promises nothing. It states no period for telling a customer of an incident, no recovery objective, no right of audit and no liability. Check for dates, actions and absolute words as well. If you do not know, answer yes and look again.

• Yes, or not known: Remove it and point to the standard commitments schedule
• No: Does a sentence name a certificate, report or standard?

Step

Remove it and point to the standard commitments schedule

Those terms belong in the agreement, through the standard security commitments schedule and its negotiation ladder. The overview says only that the schedule exists and that the customer should ask if they need something it does not offer.

• Then: Does a sentence name a certificate, report or standard?

Decision

Does a sentence name a certificate, report or standard?

Name a certificate by its exact title, scope, issuer and dates, and say whose it is. Say the organisation is certified, compliant or aligned only when the index holds a current document that says so for that scope and Legal has confirmed the wording. If you do not know, answer yes.

• Yes, or not known: Name it exactly and have Legal confirm the wording
• No: Is each listed document in date and in a tier you may name?

Step

Name it exactly and have Legal confirm the wording

A supplier's certificate is described as the supplier's, never as the organisation's own. In the pack's example the distributor holds no certificate of its own and the overview says so, which is a way to avoid leaving the customer to assume one. Legal confirms every sentence that names a certificate, a report or a standard.

• Then: Is each listed document in date and in a tier you may name?

Decision

Is each listed document in date and in a tier you may name?

List Public and Under NDA items only. A Summary only item is listed by its approved summary. A Never shared item is not listed. An expired or withdrawn document is not listed, and a supplier's document appears only as its terms allow. If you do not know, answer no.

• No, or not known: Drop it, or list its approved summary in its place
• Yes: Did someone other than the author confirm every statement?

Step

Drop it, or list its approved summary in its place

Describe each listed item by title, scope, issuer and dates, as the document states them, and no further. Where an item has expired, hold the answers that cite it until the owner renews it or the answers change.

• Then: Did someone other than the author confirm every statement?

Decision

Did someone other than the author confirm every statement?

The topic owner of each section confirms its statements, Legal confirms any sentence that names a certificate, a report or a standard, and the pack's example has the Head of Information Security approve the whole overview (who that is depends on how you are governed). Run the response check on it as on any response. Nobody approves a statement they wrote. If you do not know, answer no.

• No, or not known: Hold it. The next level confirms before it is issued
• Yes: Issue it with a version, date and review date

Outcome

Hold it. The next level confirms before it is issued

Where the author is the approver, the next level takes their place. Where the Head of Information Security wrote a statement, the executive decision-maker approves it (judgement on who that is: it follows how the organisation is governed). Do not issue an overview with an unconfirmed statement.

Step

Issue it with a version, date and review date

The overview is only as fresh as its oldest answer. Set the next review at the shortest topic interval, which is 6 months for incident notice and AI in the pack's defaults, and sooner when a statement changes. Sales may send it with the Public evidence to a customer or a prospect in a live opportunity.

• Then: Has an answer, a document or a date changed since issue?

Decision

Has an answer, a document or a date changed since issue?

Check at each review and whenever a certificate, test or policy is renewed or expires. A statement that has not been changed is still being relied on. If you do not know, answer yes.

• Yes, or not known: Change the index and library first, then the overview
• No: Offer it with the Public evidence ahead of a long form

Step

Change the index and library first, then the overview

The order is evidence index, library answer, overview. Editing the overview alone makes it disagree with the library the next form will draw from. A wrong statement already sent follows the correction route.

• Then: Copy each answer unchanged and show what it covers (back to an earlier step)

Outcome

Offer it with the Public evidence ahead of a long form

A form above the largest standard question set is first offered the overview and the evidence. Whether the customer accepts that in place of a full answer is for the triage decision.