Customer-Facing Security Overview Document
Pre-emptive security overview that answers the common questions before a questionnaire is sent.
Available soon
- Format
- Word
- Size
- 59 KB
- Length
- 16 pages
- Version
- 1.1
- Updated
What's inside
- Using this template
- About this document
- Who we are and what we provide
- How we govern security
- How we control access
- How we protect data
- How we handle security incidents
- How we keep services running
- How we build and test
- How we manage suppliers
- How we govern AI
- How we protect personal data
- How we protect our sites
- Assurance and evidence we can share
- What this document is not, and how to ask for more
- Definitions
- Adapting this template
- Notes on the example
- Framework references
What changed
- 1.1
How each section is filled says what the template does: a section takes the topic's answers that may go out as they stand, Current, Review due or Evidence expiring, as QG-05 says, not Current answers only.
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
Using this template
This template is the overview that the questionnaire response lead sends to a customer or prospect before a security form arrives, or with it. It is written for the customer to read. Everything else in the Security Questionnaire & Due Diligence Response pack is written for your own staff. The overview answers the common questions once, in plain words, so that a request of 60 questions or more can start from a document the customer has already read (IN-06).
Legal note. This document helps you answer security questionnaires from your customers. It is not legal advice, and an answer, a certificate or a schedule from this pack is not a statement that you comply with NIS2, DORA, the GDPR or any standard. A response is a statement your organisation is held to. Ask counsel to confirm any answer that a customer could treat as a promise or as a legal claim, and whether a customer is a financial entity or an essential or important entity.
Guidance — delete before approval
Every statement in this template is a [[placeholder]] or an EXAMPLE value. Before use, the topic owner confirms each statement against the control it describes and against the evidence. Delete this section, "Adapting this template", "Notes on the example" and "Framework references" before the overview is issued to a customer. Keep the sections from "About this document" to "Definitions".
A statement in the overview is a library answer (Security Answer Library), used unchanged. If a statement is wrong or out of date, change the library answer first, with its owner's approval, and then change the overview (QG-05). Do not edit a statement here. Add a statement to a section by approving it in the library first, with its scope of claim and its evidence reference (QG-06, QG-07).
The overview describes. It promises nothing (QG-09). It gives no time period for telling a customer of an incident (QG-21), no recovery objective, no right of audit and no liability. Those belong in the agreement, through the standard security commitments schedule (Standard Security Commitments Schedule).
How each section is filled
ten of the 14 sections are filled from the answers of one library topic that may go out as they stand (Current, Review due or Evidence expiring), as QG-05 says. An answer with evidence expiring says when it expires. The other four are fixed text. The overview is only as fresh as its oldest answer, so its next review date follows the shortest topic interval: 6 months, for incident notice and AI.
Section | Filled from | Owner (EXAMPLE) |
|---|---|---|
CO-01 About this document | Fixed text | Questionnaire response lead |
CO-02 Who we are and what we provide | Fixed text | Questionnaire response lead |
CO-03 How we govern security | Governance | Head of Information Security |
CO-04 How we control access | Access | Head of IT |
CO-05 How we protect data | Data protection | Head of IT |
CO-06 How we handle security incidents | Incident notice | Head of Information Security |
CO-07 How we keep services running | Resilience | Head of IT |
CO-08 How we build and test | Development | Head of IT |
CO-09 How we manage suppliers | Suppliers | Head of Information Security |
CO-10 How we govern AI | AI | Head of Risk |
CO-11 How we protect personal data | Privacy | Data Protection Officer |
CO-12 How we protect our sites | Physical | Head of Logistics |
CO-13 Assurance and evidence we can share | Fixed text | Questionnaire response lead |
CO-14 What this document is not, and how to ask for more | Fixed text | Questionnaire response lead |
Guidance — delete before approval
The response lead keeps the overview. The topic owner of each section confirms its statements, Legal confirms every sentence that names a certificate, a report or a standard (QG-10), and the Head of Information Security approves the whole document before it is issued. Nobody approves a statement they wrote (QG-08). Run the Response Quality & Over-Commitment Checklist on the overview before it is issued, as on any response (QG-11). The rules the overview follows are in the Questionnaire Response Governance Method.
A section with no answer that may go out as it stands is left out of the issued overview, and the questions it would have answered are answered for each request. An overview with ten sound sections is worth more than one with fourteen that include a statement nobody can support.
About this document
This document gives an overview of how [[organisation]] manages the security of its services and of its customers' information. We write it so that you can see our approach before you send us a security form, and so that many of your questions are answered when you do.
Field | Detail |
|---|---|
Organisation | [[organisation, legal name]] |
Services covered | [[the services this overview covers, e.g. the online ordering service]] |
Version | [[1.0]] |
As at | [[date of issue]] (EXAMPLE: 30 Sep 2026) |
Next review | [[at the latest 6 months after issue, and sooner when a statement changes]] |
Contact | [[role and address for security questions]] |
These responses describe [[organisation]] as at [[date of response]], for the scope each answer states. They are given in good faith to help [[customer]] assess its supplier. They do not change the agreement between us. A commitment is made only in the agreement or in a schedule that both parties have signed.
Each statement says what it covers. The table lists the seven ways a statement can be limited, so that you know how far to rely on it.
What it covers | What that means |
|---|---|
Whole company | True of the whole organisation, as the answer says. |
Named service | True of one named service, such as the online ordering service, and no other. |
Named site | True of named sites, such as the three warehouses, and no other. |
Named system or tool list | True of the systems or tools named, or on the list as at the date shown. |
Supplier's service, not ours | True of a supplier's service. The supplier, not the organisation, holds the control and the attestation. |
Written policy only | What the organisation's written policy requires. The answer does not say that every case meets it. |
Plan with a date | A plan that is not yet in place, stated with its date. It is never worded as present. |
Guidance — delete before approval
Use the response statement as it stands. Legal confirms its wording. In an overview sent to many customers, replace [[customer]] with the words "you" or "the customer".
Who we are and what we provide
[[Organisation]] is [[a short description of what the organisation does, and for whom]]. The services this overview covers are in the table.
EXAMPLE: our business is wholesale distribution of food and catering supplies to businesses. We have about 900 staff. Our customers are business customers: retailers, a hospital group and a regional public body.
Service | What it is | Where it runs |
|---|---|---|
Online ordering service (EXAMPLE) | The service through which our business customers place orders. | Hosted by our cloud hosting provider. |
Warehouse and distribution operations (EXAMPLE) | The storage and delivery of goods to our customers. | Three warehouses that we operate. |
[[Service]] | [[What it is]] | [[Where it runs, and who hosts it]] |
Guidance — delete before approval
Name only the services the statements below describe. A statement about the online ordering service is not a statement about the warehouses.
Do not say whether the organisation is an essential or important entity under NIS2, or a financial entity under DORA, unless Legal confirms it. The example is an important entity under NIS2 in its Member State. That fact belongs in a response when a customer asks, and Legal words it.
How we govern security
This section describes how security is directed and checked in our organisation: the policy, the roles, how we assess risk and how we train people.
Our answer (EXAMPLE) | What it covers | Evidence |
|---|---|---|
Is there an information security policy approved by management? Yes. Our information security policy is approved by our Executive Committee and reviewed every year. A signed-off summary is available. | Whole company | Information security policy, signed-off summary |
Do you hold an ISO/IEC 27001 certificate? No. We do not hold an ISO/IEC 27001 certificate for our own organisation. Our hosting provider holds one for its hosting service, and its certificate and scope statement are available. Our security programme runs under the policies described in this document. | Whole company | Hosting provider's ISO/IEC 27001 certificate and scope statement (expires 14 Nov 2026) |
How we control access
This section describes who can reach our systems, and how that access is given, changed and removed.
Our answer (EXAMPLE) | What it covers | Evidence |
|---|---|---|
How do staff sign in to business systems? Staff sign in with a personal work account through single sign-on. Systems that hold accounts are kept in an inventory with an owner, and a system found outside single sign-on is connected to it. | Whole company | Statement only |
How is access given, changed and removed? Accounts are created, changed, suspended and removed from events in the HR record, or from a sponsor register for people who are not employees. Access outside a person's standard profile needs a business reason, the approval of the line manager and the system owner, and an expiry date. | Whole company | Statement only |
How we protect data
This section describes how we classify and protect your information, and what happens to it when our services end.
Our answer (EXAMPLE) | What it covers | Evidence |
|---|---|---|
How do you classify information? Information is classified at three levels: Public, Internal and Confidential. A system takes the highest level of the information it holds. Customer contracts and price lists are Confidential. | Whole company | Statement only |
Are backups taken and tested? Data sets that our critical services need are listed in a backup coverage matrix with their owner, location and retention. We test the recovery of our critical services at least every 12 months. | Whole company | Statement only |
How is customer data returned or deleted at the end of the contract? Our standard security commitments schedule sets how and when your data is returned or deleted at the end of the services. | Whole company | Statement only |
How we handle security incidents
This section describes how we prepare for security incidents and how we tell customers about them. It states no time period. The period that applies to you is set in your agreement and in our standard security commitments schedule.
Our answer (EXAMPLE) | What it covers | Evidence |
|---|---|---|
Do you have an incident response plan? Yes. We have an incident response plan with a reporting route that staff can use, defined severity levels and named roles. We exercise it at least once a year. A summary of the latest exercise is available under a non-disclosure agreement. | Whole company | Incident response exercise summary, March 2026 (on request, under a non-disclosure agreement) |
How quickly will you notify us of an incident? The period is set in the standard security commitments schedule and in your contract. It follows the rules in our incident notification procedure. | Whole company | Statement only |
Guidance — delete before approval
Add no period for telling a customer of an incident. The incident notification rules and the standard schedule set it, and a different one here creates a second promise (QG-21). Questions that depend on the date or on the customer, such as incidents in the last twelve months, are answered for each request.
How we keep services running
This section describes how we plan for the loss of a service and how we test recovery. It states no recovery objectives. The recovery tests are described instead.
Our answer (EXAMPLE) | What it covers | Evidence |
|---|---|---|
Do you have business continuity and disaster recovery plans? Yes. Our critical services have recovery objectives and a recovery plan, and recovery is tested at least every 12 months. A statement of the latest test result is available under a non-disclosure agreement. | Whole company | Recovery test attestation, online ordering service, June 2026 (on request, under a non-disclosure agreement) |
When did you last test recovery? The latest recovery test of the online ordering service is recorded in a letter signed by the Head of IT and dated 30 June 2026. The letter is available under a non-disclosure agreement. | Named service | Recovery test attestation, online ordering service, June 2026 (on request, under a non-disclosure agreement) |
Guidance — delete before approval
State a recovery objective only if the agreement carries it. In an overview it reads as a promise. The library answer on the objectives for the online ordering service is still a draft.
How we build and test
This section describes how we find and fix weaknesses in our software and systems, and how an independent party tests them.
Our answer (EXAMPLE) | What it covers | Evidence |
|---|---|---|
Is the online ordering service tested for vulnerabilities? Yes. An independent party tests the online ordering service at least once a year. A summary of the March 2026 test is available under a non-disclosure agreement. | Named service | Penetration test summary, online ordering service, March 2026 (on request, under a non-disclosure agreement) |
How do you manage vulnerabilities and patches? Systems are in an asset inventory with a patch owner and a maintenance window. Vulnerabilities are rated for urgency, and fixes follow the monthly cycle, an expedited route or an emergency route. | Whole company | Statement only |
How we manage suppliers
This section describes how we choose and oversee the suppliers that help us serve you. It describes our policy. A certificate that a supplier holds is the supplier's own.
Our answer (EXAMPLE) | What it covers | Evidence |
|---|---|---|
Do you assess your suppliers' security? Our third-party security policy places suppliers in tiers by how critical they are and sets a questionnaire and evidence for each tier. It requires critical suppliers to be reassessed at least every 12 months and when something material changes. | Written policy only | Statement only |
Do you hold the certificates of your key suppliers? We collect certificates and independent reports from critical suppliers as part of their assessment, and we check their scope and dates. Our hosting provider's ISO/IEC 27001 certificate is available and is that provider's own. | Supplier's service, not ours | Hosting provider's ISO/IEC 27001 certificate and scope statement (expires 14 Nov 2026) |
How we govern AI
This section describes the rules we apply to artificial intelligence (AI) at work and the limits on the information that may be put into it. It places no use in a risk category and states no legal role under any law.
Our answer (EXAMPLE) | What it covers | Evidence |
|---|---|---|
Do you have an AI policy? Yes. Our AI acceptable use and security policy was approved by our Executive Committee on 11 Aug 2026. AI may be used for work only if it is on an approved list, and only with data that the list allows. | Whole company | Statement only |
Does AI make decisions about people? No AI output decides, alone, a matter that affects a person's job, pay, discipline, credit or access to a service. A named person decides. | Written policy only | Statement only |
Guidance — delete before approval
Every statement about AI is confirmed by the AI governance lead against the AI inventory and the reviews behind it (QG-20). It states no risk category and no role under any law, and the organisation's reasoning about those stays in its own records.
How we protect personal data
This section describes who is responsible for personal data and the terms we use when we process it for you.
Our answer (EXAMPLE) | What it covers | Evidence |
|---|---|---|
Are you a controller or a processor of our personal data? This depends on the processing involved. We answer for the customer concerned, with Legal, from the contract and the processing. | Whole company | Statement only |
Do you have processor terms for personal data? Where we process personal data on a customer's behalf, our standard security commitments schedule carries the terms that Article 28(3) of the GDPR asks of a processing contract. | Whole company | Statement only |
How we protect our sites
This section describes the sites we operate and how we protect them.
Our answer (EXAMPLE) | What it covers | Evidence |
|---|---|---|
How is the data centre that holds our data protected? Customer data for the online ordering service is held in our hosting provider's data centres. Their physical security is covered by the provider's certification, and we rely on its certificate and scope statement. | Supplier's service, not ours | Hosting provider's ISO/IEC 27001 certificate and scope statement (expires 14 Nov 2026) |
How do you dispose of media and records? Information is disposed of according to its classification. Confidential items are collected and destroyed by a provider that gives a certificate for each collection, and the certificate is kept. | Whole company | Statement only |
Assurance and evidence we can share
This table lists the documents we can share. We send a document that is in date and describe it as the document itself states. We do not send a document past its expiry date.
Available to you now
Document | What it covers | Dates | How to get it |
|---|---|---|---|
Hosting provider's ISO/IEC 27001 certificate and scope statement Issued by The hosting provider's certification body This is the supplier's certificate, not ours. | Supplier's service, not ours | 15 Nov 2023 Expires 14 Nov 2026 | On request, or from [[where it is published]] |
Information security policy, signed-off summary Issued by Executive Committee | Whole company | 15 Jan 2026 Expires 15 Jan 2027 | On request, or from [[where it is published]] |
Available under a non-disclosure agreement
We send these once a non-disclosure agreement covers you and the document. If you have none with us, we ask you to agree one first.
Document | What it covers | Dates | How to get it |
|---|---|---|---|
Penetration test summary, online ordering service, March 2026 Issued by An independent testing firm | Named service | 3 Apr 2026 Expires 26 Mar 2027 | On request, once a non-disclosure agreement covers you |
Data-flow diagram, online ordering service (high level) Issued by Head of IT | Named service | 12 May 2026 Expires 11 May 2027 | On request, once a non-disclosure agreement covers you |
Cyber insurance certificate Issued by The insurer | Whole company | 1 Apr 2026 Expires 31 Mar 2027 | On request, once a non-disclosure agreement covers you |
Recovery test attestation, online ordering service, June 2026 Issued by Head of IT | Named service | 30 Jun 2026 Expires 29 Jun 2027 | On request, once a non-disclosure agreement covers you |
Incident response exercise summary, March 2026 Issued by Head of Information Security | Whole company | 25 Mar 2026 Expires 18 Mar 2027 | On request, once a non-disclosure agreement covers you |
[[Further documents, from the evidence index]] | [[scope of claim]] | [[dates]] | [[how to get it]] |
We keep some internal records to ourselves. A full test report is one of them: we send its summary in its place.
Guidance — delete before approval
List only the items of the evidence index (Evidence & Attestation Library Index) that their sharing tier lets you name: Public items, and Under NDA items. A Summary only item is listed by its summary, and a Never shared item is not listed (QG-13). Describe each item by its title, scope, issuer and dates (EV-14). A supplier's certificate is shared only as the supplier's terms allow and is described as the supplier's (QG-14).
EXAMPLE: the distributor holds no ISO/IEC 27001 certificate of its own, and the overview says so (QG-10). The one certificate listed is its hosting provider's, which expires on 14 Nov 2026. The overview states the date and promises no renewal. When the new certificate arrives, update the index, then the library, then the overview.
What this document is not, and how to ask for more
This document describes our approach to security. It is not a contract, a certificate or a report by an independent party, and it does not change the agreement between us. We make a commitment only in the agreement or in a schedule that both of us have signed.
Our standard security commitments schedule, [[reference and version]], sets out the commitments we offer by default. If you need something it does not offer, tell us. We discuss it with you and put what we agree in the agreement.
To ask for more, write to [[role and address for security questions]]. We answer questions about the documents listed above and about any statement in this overview. Some questions depend on the date or on your own contract, such as incidents in the last twelve months, the number of suppliers we have assessed and our role in processing your personal data. We answer those for you when you ask.
If you prefer a standard form, tell us which one. [[Standard forms we accept, e.g. the CSA CAIQ or the Shared Assessments SIG, and in which format]].
[[If we find that a statement in this overview is wrong, we correct it and tell the customers who have relied on it. Legal confirms this wording before it is used.]]
Guidance — delete before approval
Keep this section short. Add no promise to reply by a date or to notify unless the standard schedule carries it (QG-09, QG-19). The correction sentence is a placeholder because Legal decides what the organisation can say. Sales may send the overview, with the Public evidence, to a customer or a prospect in a live opportunity (IN-04). Anything beyond that goes to the response lead.
Definitions
These words have the same meaning wherever they appear in this overview.
Term | Meaning in this overview |
|---|---|
What it covers | What an answer covers: the whole company, a named service, a named site, a named system or tool list, a supplier's service, a written policy only, or a plan with a date. An answer never implies a wider scope than its evidence has. |
Evidence | A document that supports an answer: a certificate, an audit report, a penetration test summary, a policy extract, a diagram, an insurance certificate or an attestation letter. |
Attestation | A signed statement by a named person of a fact they have checked, such as the result of a recovery test, with its date and scope. |
Non-disclosure agreement | A non-disclosure agreement that covers the recipient and the document, in force on the day the document is sent. |
Commitment | A promise to do something or to provide something, with a date or a continuing duty. A commitment found in an answer is logged, owned and tracked. |
Adapting this template
Small organisation
Guidance — delete before approval
Publish the sections you can stand behind and leave out the rest. A small organisation often has Current answers for four or five topics and drafts for the others. That is a sound overview. Answer the remaining questions for each request, and add a section when its answers are approved and have evidence.
One person may own several topics. Nobody approves what they wrote (QG-08): ask the Head of Information Security, or an outside adviser, to read it.
Regulated customers and regulated organisations
Guidance — delete before approval
Customers that are essential or important entities under NIS2, or financial entities under DORA, have their own duties to manage the security of their suppliers (NIS2 Article 21(2)(d) and 21(3); DORA Articles 28 to 30). The overview does not answer those duties and does not say that it does. It is one input to the customer's assessment. The contract terms a financial entity needs come from the agreement, through the standard schedule (Standard Security Commitments Schedule).
If your organisation is itself an essential or important entity, or a financial entity, say so in a response only in words that Legal confirms. The overview states no legal status and no category of any text.
A customer may follow the model of the third-party security pack (P06-A04 Supplier Criticality & Tiering Model). P06 covers the questionnaires your organisation sends to its suppliers. This pack covers the ones it receives from its customers and answers as a supplier. P06's tiers, clause library and evidence checklist show what a customer that follows the same model will probably ask for. This pack does not change them.
IT and services run by service providers
Guidance — delete before approval
If an outsourced service provider, such as a cloud host or a managed IT supplier, runs part of what you describe, say so in the statement and name the scope as a supplier's service. A control that the provider holds is the provider's, and so is its certificate. Check the provider's terms before you list its certificate or report, and describe it as the provider's (QG-14).
Ask the provider for the scope statement and the expiry date of each document you list, and put both in the evidence index (Evidence & Attestation Library Index). Delete this section before issue.
Notes on the example
EXAMPLE, not part of the overview. The organisation is the one used throughout the pack, now as a seller: a wholesale distributor with about 900 staff, three warehouses and an online ordering service. Its business customers send it questionnaires. The overview above uses its library as at 30 Sep 2026.
The library holds 50 answers. The overview shows 21 of 50: the questions customers ask first, two or three a topic, to keep the document short. 10 more could be shown. 19 cannot, because they are drafts, stale, withdrawn, or answered afresh for each request. The answers came from earlier forms and spreadsheets. Each keeps the date its owner last confirmed it, so some are past their review dates.
Topic | Shown | Current, not shown | Cannot be shown, and why |
|---|---|---|---|
Governance | 2 of 5 | 2 | SA-002 stale |
Access | 2 of 5 | 1 | SA-008 stale; SA-009 not approved |
Data protection | 3 of 5 | None | SA-012 not approved; SA-013 not approved |
Incident notice | 2 of 5 | 1 | SA-019 stale; SA-020 answered for each request |
Resilience | 2 of 5 | 2 | SA-022 not approved |
Development | 2 of 5 | 1 | SA-027 withdrawn; SA-029 not approved |
Suppliers | 2 of 5 | 2 | SA-032 answered for each request |
AI | 2 of 5 | 1 | SA-037 stale; SA-038 stale |
Privacy | 2 of 5 | None | SA-041 not approved; SA-044 not approved; SA-045 answered for each request |
Physical | 2 of 5 | None | SA-046 stale; SA-047 not approved; SA-050 not approved |
All topics | 21 of 50 | 10 | 19 answers |
Guidance — delete before approval
The one withdrawn answer (SA-027) promised a test cycle for all systems that the evidence did not support. It stays in the library so that the responses that used it can be found, and it is not in the overview.
Several answers shown carry an over-commitment flag that the approvers cleared in the library, such as a period of twelve months for training or for a recovery test. If the control changes, the library answer changes first. three answers, in three sections, cite the hosting provider's certificate, which expires on 14 Nov 2026. They are usable now and show the expiry date.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); CSA CCM, CAIQ and STAR, the Shared Assessments SIG, and SOC 2 (by name and title only), as their publishers state them; as published and read on 9 October 2026.
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Clause 4.2 — Understanding the needs and expectations of interested parties | About this document; Assurance and evidence we can share: what the interested parties, here customers, expect of the organisation's security |
NIST CSF 2.0 | GV.OC-04 — “Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated” | The whole overview: what customers and others expect of the organisation, understood and answered in advance |
NIS2 — Directive (EU) 2022/2555 | Article 21(3) — measures take into account each direct supplier's specific vulnerabilities and the overall quality of its products and cybersecurity practices, including secure development | Assurance and evidence we can share: a customer that is an essential or important entity weighs the quality of its suppliers' practices, and this overview is one input |
GDPR — Regulation (EU) 2016/679 | Article 32(1) — appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the likelihood and severity of risk to people's rights and freedoms | How we protect data; How we protect personal data: security suited to the risk |
ENISA, Procurement guidelines for the cybersecurity of hospitals and healthcare providers (July 2026) | Measure SOURCE-01 asks hospitals, when feasible, to prioritise suppliers “who demonstrate certified compliance with relevant security standards and regulations”; its checks include criteria that “prioritise suppliers with certified or independently assessed security postures” and an assessment of the supplier's incident response plans | Assurance and evidence we can share: a hospital is told to prefer suppliers with certified or independently assessed security, so the evidence is listed with its scope |
ENISA, Procurement guidelines for the cybersecurity of hospitals and healthcare providers (July 2026) | Section 2.2.1 — where AI is involved, procurement documentation should require suppliers to disclose “the intended purpose and scope of the AI functionality, the AI provider and deployment model, relevant data processing arrangements, categories of data processed, storage and retention arrangements, subprocessors, human oversight measures, logging capabilities”, and procedures for notifying the healthcare entity of material changes. Sensitive information should not go to external AI services unless expressly authorised after the assessments the section lists | How we govern AI: the points a hospital is told to ask a supplier about AI, answered in advance |
UK NCSC, Supply chain security guidance | Principle 5, “Set and communicate minimum security requirements for your suppliers” — “You should set minimum security requirements for suppliers which are justified, proportionate and achievable.” It asks the buyer to consider “different protection requirements for different types of contracts, based on the risk associated with them”, and to avoid forcing every supplier to meet the same set | About this document; What this document is not, and how to ask for more: a buyer sets requirements that fit the contract, so this overview describes and promises nothing |
Cloud Security Alliance (CSA) | CSA STAR (Security, Trust, Assurance and Risk): “a publicly accessible registry that documents the security and privacy controls provided by popular cloud computing offerings”. Level 1 is a self-assessment that submits the CAIQ. Level 2 builds on third-party audits: a STAR Certification for ISO/IEC 27001, whose certificates “expire after three years unless updated”, and a STAR Attestation for SOC 2, whose listings “will expire after one year unless updated”. CSA says publishing to the registry can help “alleviate the need to fill out multiple customer questionnaires” | Assurance and evidence we can share: a public registry entry can reduce the number of separate questionnaires |
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, DORA or the GDPR, or that your organisation holds a certificate.
This pack does not say which certificate, report or form meets a requirement of NIS2, DORA or the GDPR. Each reference says what its source asks of the customer or the provider and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.
The CSA CAIQ, CCM and STAR, the Shared Assessments SIG and the certificates and reports a customer may ask for are industry practice and voluntary guidance. They are not law. No law named here requires you to complete a customer's form, and completing one, or holding a certificate or report, is not a statement that you comply with NIS2, DORA, the GDPR or any standard. This pack cites each as its publisher states it. ENISA's guidance and the NCSC's principles are guidance for buyers. They are not law, and they do not say what the contract between you and a customer must hold. ENISA says its publication does not endorse a regulatory obligation.