When do we share a report, certificate or policy with a customer, and on what terms?

Start

A customer asks for a report, certificate or policy

Treat every such request as a request for evidence, whoever receives it. Evidence supports answers the organisation is held to, and some of it must never leave. The rule is the same for a short email, a call or a line in a questionnaire: nothing goes out until the evidence index and the release rules have been applied.

• Then: Is the sender a customer, or a prospect in a live sale?

Decision

Is the sender a customer, or a prospect in a live sale?

Only customers and prospects in a live sales opportunity are answered. Anyone else is declined and the reason recorded. Sales may still send the Public overview and Public evidence to them. If it is not clear who the sender is, treat the answer as no until the account owner confirms.

• Yes: Is the item in the evidence index?
• No, or not known: Decline, send only Public items, record why

Outcome

Decline, send only Public items, record why

Reply politely and send nothing beyond the Public overview and Public evidence. Record the decline and the reason in your request log. Sales may send the Public overview and Public evidence, and nothing else goes.

Decision

Is the item in the evidence index?

The index lists what the organisation may send, with each item's scope, issuer, owner, dates and sharing tier. A document found on a shared drive but missing from the index has no tier and no owner, so nobody has decided who may see it. If you are unsure, answer no.

• Yes: Has it expired or been withdrawn, or is that unknown?
• No, or not known: Do not send; ask the response lead to place it first

Outcome

Do not send; ask the response lead to place it first

Judgement call: the pack gives every item a tier and an owner but does not say how to treat a document that is not indexed. This flow takes the cautious route. The response lead and the Head of Information Security decide whether it joins the index and in which tier. Meanwhile tell the customer what is available now, from the Public items.

Decision

Has it expired or been withdrawn, or is that unknown?

Check the expiry date on the day you send, not on the day the item was indexed. An item past its expiry date, or withdrawn, is not sent. The answers that cite it are held until its owner renews it or changes them.

• Yes, or not known: Do not send; the owner renews it or replaces it
• No: Is it a supplier's document, not the organisation's own?

Outcome

Do not send; the owner renews it or replaces it

Tell the customer only what the owner has confirmed about renewal, and give no date the owner has not confirmed. Sending an expired certificate or report is a wrong answer, and the correction route applies if it has already gone. Do not hide it.

Decision

Is it a supplier's document, not the organisation's own?

A hosting provider's certificate or report belongs to the provider, which holds the control and the attestation. Its scope of claim is the supplier's service, not ours. It is shared only as the supplier's terms allow, and never shown as the organisation's own.

• Yes, or not known: Do the supplier's terms allow you to share it?
• No: Which sharing tier is the item in?

Decision

Do the supplier's terms allow you to share it?

Read the terms the index records for that supplier. If they are not recorded or not clear, answer no and ask the owner to check with the supplier.

• Yes: Label it as the supplier's, with its scope
• No, or not known: Do not send; point the customer to the supplier

Outcome

Do not send; point the customer to the supplier

Tell the customer whose document it is and that the supplier controls its release. Offer what the organisation can say on its own account instead, within its own scope. Do not describe the supplier's controls as the organisation's.

Step

Label it as the supplier's, with its scope

State the supplier's name and the scope on the document, for example the hosting service and not the organisation's systems. The customer must not be able to read it as the organisation's own certificate.

• Then: Which sharing tier is the item in?

Decision

Which sharing tier is the item in?

Every indexed item has exactly one tier. The tier decides who releases it and whether it may go at all. Public needs no further agreement. Under NDA needs an agreement in force. Summary only is never sent as it stands. Never shared is not sent.

• Public: Will you say the organisation is certified or compliant?
• Under NDA: Does an NDA cover the recipient and this document today?
• Summary only: Send the approved summary named in the index instead
• Never shared, or not known: Do not send; offer the overview and Public items

Outcome

Do not send; offer the overview and Public items

Internal workpapers such as internal control test results never leave the organisation. Only the Head of Information Security and Legal together can change a tier. A customer who insists is told what is available instead, and the request is logged.

Step

Send the approved summary named in the index instead

An item such as a full penetration test report holds detail an attacker could use, so the item stays inside. Its approved summary goes in its place, released by the Head of Information Security. The summary has its own sharing tier, so this flow checks the summary again from the start: a recipient with no agreement in force gets it only where the summary's own tier is Public (EV-13).

• Then: Has it expired or been withdrawn, or is that unknown? (back to an earlier step)

Decision

Does an NDA cover the recipient and this document today?

The agreement must be in force on the day of sending and cover the recipient and the document. An agreement with a customer's lawyers does not by itself cover its security team: ask Legal. If cover is unclear or has lapsed, answer no.

• Yes: Will you say the organisation is certified or compliant?
• No, or not known: Offer Public items and summaries; Legal requests an NDA

Outcome

Offer Public items and summaries; Legal requests an NDA

Send the Public items, and a summary only where the summary's own tier is Public, and ask Legal to put an agreement in place. Send the Under NDA item once Legal confirms it covers the recipient. Tell the customer what is waiting on the agreement.

Decision

Will you say the organisation is certified or compliant?

Describe the item by its title, scope, issuer and dates, as the document states them, and no further. A statement that the organisation is certified, compliant or aligned is a legal claim about a scope. It is made only when a current document in the index says it for that scope and Legal has confirmed the wording. If unsure, answer yes.

• Yes, or not known: Hold the wording; Legal confirms it first
• No: Does it expire within 60 days?

Outcome

Hold the wording; Legal confirms it first

Remove the claim or have it confirmed. Name the document and say whose it is, but leave out any statement that the organisation holds a certificate or is compliant unless the index and Legal support it. The distributor in the pack's example holds no certificate of its own and says so.

Decision

Does it expire within 60 days?

The pack's default warning window is 60 days. Say in the response when an item expires within it, and state the date. Say that it is being renewed only if the item's owner has confirmed that.

• Yes, or not known: Put the expiry date in the response
• No: Add the covering statement and send through the customer's channel

Step

Put the expiry date in the response

Write the date plainly. Do not word it as a promise, such as 'we will renew by', which turns a description into a commitment the customer can hold you to. Mention renewal only if the item's owner has confirmed it.

• Then: Add the covering statement and send through the customer's channel

Step

Add the covering statement and send through the customer's channel

The covering statement says the response describes the organisation as at a date, for the stated scope, and that any commitment is made only in the agreement. The account owner sends only what the response lead released, by the customer's channel or an encrypted route. Releasing needs the person the tier names.

• Then: Record the item, recipient and date, then close

Outcome

Record the item, recipient and date, then close

Record the item, the recipient and the day in your request log, and keep an exact copy of what was sent with the item versions. If the item or its date later proves wrong, the log shows who received it.