Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If an answer we gave a customer turns out to be wrong, then what do we do?

4 decision pointsThe pack behind this answer: Security Questionnaire & Due Diligence Response

Add to board memo

The short answer

Recommendation
Withdraw the answer from your library at once, find every response and customer that used it, and rate the error. A material error gets a written correction approved by Legal and the Head of Information Security and sent by the account owner. A minor one is fixed in the library with no customer notice.
Reasoning
A wrong answer stays wrong in every response that used it, and the customer may still rely on it. Withdrawing it first stops the next response reusing it, and keeping it in the library with the reason lets you find who received it. The rating decides how far the correction goes. An unsupported commitment or an overstated scope is always material, and so is any error the customer relied on or that is written into the contract. Other errors are minor.
Considerations
  • The pack's default is to send a material correction within 5 working days of the error being confirmed. Your own standard or contract may set another period.
  • An error that shows a control does not work, or exposes personal data, is also reported as an event through your incident route, whatever its rating.
  • Where the customer relied on the answer or it is written into the contract, Legal decides whether the contract is amended.
  • Without a stored copy of each response, you cannot show who did not receive the answer. Treat every customer who could have received it as affected until the account owner confirms otherwise.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartWe find an answer we gave a customer was wrongStepWithdraw the answer from the library and record the causeDecisionDo we hold a copy of every response as sent?StepList every response and customer that used the answerStepJudgement: treat all possible recipients as affectedStepTopic owner states the right answer; the lead drafts the correctionDecisionDid the customer rely on it, or is it in the contract?StepLegal decides whether the contract needs amendingDecisionIs it an unsupported commitment or an overstated scope?StepLegal and Head of Information Security approve a written fixStepAccount owner sends it within 5 working days of confirmationStepMinor: fix the library, tell the account owner, no customer noticeDecisionDoes it show a control that fails, or expose personal data?StepReport it as an event through the incident routeStepLog the correction as Corrected and review why it happenedStepReview the method, as a wrong answer is a review triggerOutcomeCorrected, customers told as the rating requires, closed in the log

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 17 steps.

  1. Start

    We find an answer we gave a customer was wrong

    The owner may find it at a review, a customer may raise it, or someone may compare two responses. Do not wait for a perfect correction. The order matters: stop the answer being used again, find who was told, then write the right answer. The steps are the same every time, and the rating of the error decides how far they go.

    In the pack

  2. Step

    Withdraw the answer from the library and record the cause

    Do this first and at once, so the next response cannot reuse it. A withdrawn answer stays in the library with the reason, which is what lets you find the responses that used it. Note the kind of error: a factual error, overstated scope, unsupported commitment, outdated answer or wrong evidence.

    In the pack

  3. Decision

    Do we hold a copy of every response as sent?

    The method keeps an exact copy of every response as sent, with its approvals and the evidence it cited, so the search for who was told what is quick. If a copy is missing, or you cannot tell, widen the search. As a judgement, the pack being silent here, treat every customer who could have received the answer as affected until the account owner confirms otherwise.

    In the pack

  4. Step

    Judgement: treat all possible recipients as affected

    This is a judgement of this guide, not a pack rule. Without the stored copy you cannot prove who did not receive the answer, so take the cautious list and narrow it only on the account owner's evidence. Then fix the record-keeping so that the next response is stored as sent.

    In the pack

  5. Step

    Topic owner states the right answer; the lead drafts the correction

    The person who runs the control says what is true today and what it covers. The response lead drafts the correction from that statement. A new answer is not a quick edit: it takes the approval the kind of answer sets, and nobody approves an answer they wrote.

    In the pack

  6. Decision

    Did the customer rely on it, or is it in the contract?

    Reliance means the customer decided something because of the answer, such as buying or relaxing its own checks. Ask the account owner. An answer copied into a contract schedule or an order form also counts. If you do not know, answer yes: an error that reached a contract or a decision is material.

    In the pack

  7. Step

    Legal decides whether the contract needs amending

    Legal reads the contract and the answer together and decides whether to amend the contract, as well as correct the answer. Legal is also one of the two approvers of the written correction, so involve it before the wording is settled.

    In the pack

  8. Decision

    Is it an unsupported commitment or an overstated scope?

    An unsupported commitment promises something the contract or the controls do not support, such as a test cycle or a notice period nobody agreed. An overstated scope claims more than the evidence covers, such as one service described as the whole company. Both are always material. If you are unsure which it is, answer yes.

    In the pack

  9. Step

    Legal and Head of Information Security approve a written fix

    A material correction is in writing and has two approvers. Where one of them wrote the wrong answer, the next level takes their place (QG-08 sets this for answers; applying it to the correction is a judgement).

    In the pack

  10. Step

    Account owner sends it within 5 working days of confirmation

    The pack's default is 5 working days from the day the error is confirmed, and your own standard may set another. The account owner sends it, because they hold the relationship. If no separate confirmation date is kept, the pack counts from the day the error was found.

    In the pack

  11. Step

    Minor: fix the library, tell the account owner, no customer notice

    Correct the answer in the library, tell each account owner, and put the right answer in the next response to that customer. No notice is sent.

    In the pack

  12. Decision

    Does it show a control that fails, or expose personal data?

    Ask the topic owner. An answer that says a control exists when it does not, or reveals personal data in the reply, is more than a wording problem. Yes, or not known, takes the cautious branch. This applies to minor and material errors alike.

    In the pack

  13. Step

    Report it as an event through the incident route

    Report it through your incident reporting route. Incident handling, classification and any reporting duties then follow your incident procedure, not this correction. Carry on with the correction in parallel so the customer is not left with the wrong answer.

    In the pack

  14. Step

    Log the correction as Corrected and review why it happened

    Record it in the commitments log as Corrected and count it in the measures. The log is your own record. Then ask how the error got through, for example no owner review, expired evidence, or a promise that never reached Legal.

    In the pack

  15. Step

    Review the method, as a wrong answer is a review trigger

    The method is reviewed after a wrong answer is found, so do this whatever the rating. Judgement of this guide: have the owner of the topic also look at its other library answers.

    In the pack

  16. Outcome

    Corrected, customers told as the rating requires, closed in the log

    The wrong answer is out of use, every affected customer has been dealt with under the rating, and the log shows the correction. Keep the file with the stored responses.

    In the pack

Practical checklist

  1. Withdraw the answer from the library at once, and record the cause and the kind of error.
  2. Search the tracker and the stored responses, and list every response and customer that used the answer.
  3. Have the topic owner state the correct answer, and the response lead draft the correction from it.
  4. Rate the correction minor or material, asking the account owner whether the customer relied on it.
  5. For a material error, have Legal and the Head of Information Security approve a written correction, and the account owner send it within the window.
  6. For a minor error, correct the library, tell the account owner and put the right answer in the next response.
  7. Report it through the incident route if it shows a control that does not work or exposes personal data.
  8. Log the correction as Corrected, review why it happened, and review the method.

Evidence to have ready

  • The withdrawn library entry, with its reason and the kind of error.
  • The list of responses and customers that used the answer, from the tracker and the stored copies.
  • The rating, the approvals of a material correction, and the dates the error was confirmed and the customer was told.
  • Legal's decision on any contract amendment, and the incident report where one was made.
  • The commitments log entry marked Corrected, and the record of the method review.

Assumptions

  • You keep a library of approved answers and a record of each response as sent, even a simple one.
  • The 5 working days are the pack's default for telling a customer of a material correction. Your own standard or contract may set a different period.
  • Legal, the Head of Information Security and an account owner exist, under those titles or equivalents.

Not covered here