Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If a customer asks us to commit to a security term we cannot meet, then what do we do?

7 decision pointsThe pack behind this answer: Security Questionnaire & Due Diligence Response

Add to board memo

The short answer

Recommendation
Agree nothing in the form, on a call or by email. Offer the standard schedule wording, then its pre-approved alternative as written. Anything beyond that is an exception: rate it, get written approval from the approvers its band sets and record it before the customer is told yes, or decline in writing.
Reasoning
A form is not the place to agree a commitment, because the customer can hold you to it. The standard schedule holds the promises you are willing to make, and its alternative wording is already approved, so most asks are settled there. A term beyond the alternative leaves a risk the organisation has not yet accepted, so it is rated and approved as an exception, with a fixed expiry. A term that no control or contract supports is never left in the text.
Considerations
  • The bands, approvers and longest terms are the pack's defaults: 365 days for Low, 180 for Medium, 90 for High and 30 for Critical. Your own exception standard may set others.
  • A Critical exception goes to Legal and the board, or a board risk committee it has delegated to; the management board in a two-tier structure; or executive management where there is no board.
  • Where a customer says a law or regulator requires the term, such as a financial entity using the service for a critical or important function, counsel decides what is needed before you reply.
  • Nobody approves a departure they own. Where personal data is involved, the Data Protection Officer joins the approvers. An approver may refuse, shorten the term or add conditions.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA customer asks for a security term we cannot meetStepAgree nothing yet and pass the ask to the response leadDecisionDoes our standard wording already give the customer what it needs?OutcomeOffer the standard schedule as writtenDecisionDoes the pre-approved alternative wording cover the request?OutcomeOffer the alternative wording as written; Legal and security approveDecisionDoes the customer say a law or regulator requires the term?OutcomeSend it to counsel; agree nothing by email or on a callDecisionCould we meet the term today, with evidence that it holds?StepLegal and the account owner rate the risk the departure leavesDecisionIs the risk High or Critical, or not yet rated?StepLow: Legal and control owner. Medium: Legal and Head of SecurityStepHigh: add the executive. Critical: Legal and board or equivalentDecisionDoes the term involve personal data?StepAdd the Data Protection Officer to the approversDecisionHave all the approvers agreed in writing?OutcomeDecline in writing or wait for approval; hold to standard or fallbackStepRecord the exception with its expiry, and log the commitmentOutcomeOffer the exception through the response lead

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 19 steps.

  1. Start

    A customer asks for a security term we cannot meet

    The ask may sit in a questionnaire, a call, an email or the customer's own contract schedule. Whatever the route, a security answer is a statement the organisation is held to, and a form is not the place to agree a new commitment. Promises are made in the contract, through the standard schedule and a short ladder of approvals.

    In the pack

  2. Step

    Agree nothing yet and pass the ask to the response lead

    Do not say yes on a call or in an email, and do not write a promise into a form. The account owner manages the relationship and writes no security answer. The questionnaire response lead logs the ask, and the account owner tells the customer that the security team will reply.

    In the pack

  3. Decision

    Does our standard wording already give the customer what it needs?

    Read the customer's wording against the commitments in the standard schedule, clause by clause. Wording that matches a commitment stays standard. If the match is partial or you cannot tell, answer no and go on to the fallback wording.

    In the pack

  4. Outcome

    Offer the standard schedule as written

    The account owner offers the standard wording with the security overview. It needs no approval beyond the schedule's own. Keep the signed copy with the response. Anything the customer asked for in the form that the schedule does not hold goes in the commitments log.

    In the pack

  5. Decision

    Does the pre-approved alternative wording cover the request?

    Each of the ten commitments has a pre-approved fallback, for example report-based assurance in place of a right to audit, or a notice by updated list in place of approval of each supplier. The fallback is used as written. If the customer wants anything beyond it, or you cannot tell, answer no.

    In the pack

  6. Outcome

    Offer the alternative wording as written; Legal and security approve

    The account owner offers the fallback. Legal and the Head of Information Security approve its use. Change nothing in the wording: an edited fallback is an exception. Fill any placeholder from something you can keep today, such as the test cycle that runs now.

    In the pack

  7. Decision

    Does the customer say a law or regulator requires the term?

    Some customers, such as a financial entity using the service for a critical or important function, ask for rights the standard wording does not give. What a regulation needs is a legal question. Answer yes if the customer says so or you do not know whether it applies.

    In the pack

  8. Outcome

    Send it to counsel; agree nothing by email or on a call

    Counsel decides what the regulation needs and what the organisation can offer. The reply to the customer waits for that decision. The organisation does not agree to more in an email or on a call. The response is not a statement of compliance with any law.

    In the pack

  9. Decision

    Could we meet the term today, with evidence that it holds?

    A commitment that no control or contract term supports is changed first, with Legal, and never left in the text. Ask the owner of the control whether it runs and what evidence exists. Where the term depends on something not yet in place, the safer answer is no. Offering it with a dated plan as its support is a judgement for Legal and security.

    In the pack

  10. Step

    Legal and the account owner rate the risk the departure leaves

    Rate impact and likelihood, each from 1 to 4, on the scales of the risk method. The exception is a departure from the standard and the questionnaire response lead offers it. The band sets the approvers and the longest term. Use the pack's default bands unless your own standard sets others.

    In the pack

  11. Decision

    Is the risk High or Critical, or not yet rated?

    Low and Medium bands go to Legal with the control owner or the Head of Information Security. High and Critical go higher. A risk that has not been rated takes the higher branch until it is.

    In the pack

  12. Step

    Low: Legal and control owner. Medium: Legal and Head of Security

    Pack defaults: a Low exception lasts at most 365 days and a Medium one 180. The people who own the risk do not approve it. If the owner is the Head of Information Security, the accountable executive takes that place. Your own standard may set other terms.

    In the pack

  13. Step

    High: add the executive. Critical: Legal and board or equivalent

    Pack defaults: a High exception lasts at most 90 days and needs Legal, the Head of Information Security and the accountable executive. A Critical one lasts at most 30 days and needs Legal and the board or its equivalent. That is the board, or a committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board.

    In the pack

  14. Decision

    Does the term involve personal data?

    Examples are a data return period, a processor term or access to records that hold personal data. If it does, or you do not know, answer yes. The Data Protection Officer then approves the commitment as well.

    In the pack

  15. Step

    Add the Data Protection Officer to the approvers

    An exception that carries personal data adds the Data Protection Officer to the approvers of the commitment. If the Data Protection Officer wrote the answer, Legal takes that place, because nobody approves what they wrote.

    In the pack

  16. Decision

    Have all the approvers agreed in writing?

    Every approver in the band must agree, in writing, before the customer hears yes. An approver may refuse, shorten the term or add conditions. If any approver has refused or has not yet answered, answer no. Nothing is offered to the customer until all have agreed.

    In the pack

  17. Outcome

    Decline in writing or wait for approval; hold to standard or fallback

    Tell the customer which commitments the organisation can give, and offer the standard or the fallback wording. Say plainly what is not offered. If the answer is only that an approver has not yet replied, agree nothing, tell the customer the reply is pending and decline only if an approver refuses. Keep the customer's wording and the decision with the request file.

    In the pack

  18. Step

    Record the exception with its expiry, and log the commitment

    Record the exception on the exception form before the customer is told yes. It has a fixed expiry, set at approval, no later than its band allows. Log the commitment in the tracker's commitments log with an owner, a due date and what supports it.

    In the pack

  19. Outcome

    Offer the exception through the response lead

    The response lead offers the approved wording, and the signed copy is kept with the response. The exception expires on its fixed date like any other. Report open commitments each month.

    In the pack

Practical checklist

  1. Agree nothing yet, and pass the ask to the questionnaire response lead.
  2. Read the customer's wording against the standard schedule, commitment by commitment.
  3. Offer the standard wording, or the pre-approved alternative unchanged with the approval of Legal and the Head of Information Security.
  4. Send any term the customer says a law or regulator requires to counsel before replying.
  5. Ask the control owner whether the term can be met today, and what evidence shows it.
  6. Have Legal and the account owner rate the risk the departure leaves on your risk method's impact and likelihood scales.
  7. Get written approval from every approver the band sets, adding the Data Protection Officer where personal data is involved.
  8. Record the exception with its fixed expiry and log the commitment before the customer is told yes, or decline in writing.

Evidence to have ready

  • The customer's wording, kept with the request file and the decision on it.
  • The signed schedule, with any alternative wording offered, kept with the response.
  • For an exception: the risk rating, the band, each approver's written approval and the fixed expiry date.
  • The commitments log entry, with its owner, due date and what supports it.
  • Counsel's decision where the customer cited a legal or regulatory requirement.

Assumptions

  • You have a standard security commitments schedule with a pre-approved alternative for each commitment, or you will write one first. Without it, every departure is an exception.
  • You have a named questionnaire response lead, Legal input and a named Head of Information Security. In a small team, one person may hold two roles but still cannot approve what they wrote.
  • The bands, approvers and longest terms shown are the pack's defaults. Your own exception standard may set others, and the top approver depends on how your organisation is governed.

Not covered here