Evidence & Attestation Library Index

Indexes shareable evidence with sharing conditions, NDA requirement and expiry.

Available soon

Format: Excel
Size: 98 KB
Length: 11 sheets
Version: 1.0
Updated: 9 Oct 2026

Follow this documentFree account. We can email you when it changes.

What's inside

Instructions
Evidence Index
Release Check
Index Counts
Types and Rules
Lists
Definitions
Framework References

What changed

1.09 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	What this workbook is. It is the evidence index of Questionnaire Response Governance Method: one row for each document you may show a customer (QG-06, QG-13, EV-08 to EV-14). The Security Answer Library cites a row by its item ID.
2	Start on the Index Counts sheet. Type the as-at date, which is the date the index is checked at. Type a date, never a formula. Check the warning window: 60 days is the house default (EV-09).
3	Enter one row for each item on the Evidence Index sheet. Yellow cells are inputs. Choose from the lists where a cell has one. Write the title, the issuer and the dates as the document states them (EV-14), and nothing more.
4	Choose the scope of claim from CS-1 to CS-7. It says what the document covers: the whole company, a named service, a named site, a system list, a supplier's service, a written policy or a plan with a date. The Types and Rules sheet lists them. A document never covers more than its own scope statement (QG-07).
5	Mark a supplier's document with the supplier's reference and its terms. Share it only if the terms say permitted, and label it as the supplier's (EV-11, QG-14). Never show it as your own.
6	Choose the sharing tier. Public goes to anyone. Under NDA goes only where a non-disclosure agreement covers the recipient on the day. Summary only never goes itself: give its summary a row of its own and enter that row's ID. Never shared stays inside. A change of tier is a decision of the Head of Information Security and Legal.
7	Read the calculated columns at the right of the Evidence Index sheet. "Fields to fix" says what EV-08 still needs. "Expiry" says Expired, Expiring or In date. "Released by" names the role that releases the item (QG-13). "Goes out as" says what happens to it.
8	Before you send evidence, open the Release Check sheet. Enter the send date and the recipient, and the dates of the non-disclosure agreement in force. Ask Legal to confirm that the agreement covers the recipient and the document. The sheet shows each item as Send, Summary in its place, or Not sent with the reason (EV-13).
9	Record what you send in the Questionnaire Request Tracker: the item, the recipient and the day (EV-12). This workbook says what may go. It does not record what went.
10	Renew an item before it expires. The Index Counts sheet lists every item that expires inside the window (EV-09). An answer that cites an expired item is held until its owner renews the item or changes the answer (EV-10). Mark a withdrawn item Withdrawn and keep its row.
11	Report the counts each month (QG-23). They are on the Index Counts sheet, with the sentences for the report.
12	To clear the EXAMPLE, delete the EXAMPLE rows on the index sheet and the recipients on the release sheet once your own are entered. The formulas stay.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Why an index. A questionnaire answer is a statement the organisation is held to. A customer reads it as a description of what the organisation does, relies on it when it decides to buy, and may point to it later if something goes wrong. So the organisation answers once, from an approved source, with evidence behind it, and says what the answer covers. A form is not the place to agree a new commitment. Promises are made in the contract, through a standard schedule and a short ladder of approvals, and an answer never promises what the contract or the controls do not support. The result is counts of requests answered on time, answers reused, evidence in date and commitments kept. It is never one score.

Limitations: This document helps you answer security questionnaires from your customers. It is not legal advice, and an answer, a certificate or a schedule from this pack is not a statement that you comply with NIS2, DORA, the GDPR or any standard. A response is a statement your organisation is held to. Ask counsel to confirm any answer that a customer could treat as a promise or as a legal claim, and whether a customer is a financial entity or an essential or important entity.

A document in this index shows what its issuer says, for the scope and the period it states. It does not show that an answer is true for anything wider (QG-10). Say that the organisation is certified, compliant or aligned only when the index holds a current document that says it for the scope stated and Legal has confirmed the wording.

EXAMPLE: the distributor, a wholesale distributor with about 900 staff, three warehouses and an online ordering service, as at 30 Sep 2026. Its index holds 9 items. The distributor holds no ISO/IEC 27001 certificate of its own. Its hosting provider holds one for the hosting service. P08's example is a different company, a software firm working towards its first certificate.

Adapting this template:

• Small organisation: one person may keep the index and own every item. Start with the few documents customers ask for most: a policy extract, your hosting provider's certificate, an insurance certificate and a test summary. Keep every column. A short index with dates is worth more than a long one without.

• Regulated organisation: your customers or your regulator may ask for more evidence, for longer, or under a form of agreement you cannot change. Add rows and notes, and have Legal read the agreement before you release an Under NDA item. Counsel confirms whether a customer is a financial entity.

• IT run by a service provider or outsourced: much of your evidence is the provider's. Enter it with the provider's reference and its terms, label it as theirs, and ask the provider in writing whether you may share it. Do not show it as your own.

• Larger group: keep one index for each legal entity or service where the scope differs. Do not copy a certificate onto a row for an entity it does not cover.

This workbook is your own record. Keep a copy that can be reached when the main systems are down.

Evidence Index

EXAMPLE: 9 items as at 30 Sep 2026. One row for each document you may show a customer. Yellow columns are inputs; white columns calculate. The Release Check sheet says what may go to a named recipient.

Example	Item ID (EI-nn)	Title of the document, as it states it	Type (EV-01 to EV-07)	Scope of claim (CS-1 to CS-7)	Issuer or signer	Owner	Issued	Expires (a date, or None)	Sharing tier	Summary item (Summary only items)	Supplier reference (a supplier's document)	Supplier's terms for sharing	Status	Notes	Days to expiry (calc)	Expiry (calc)	Fields to fix (calc)	Released by (calc)	Goes out as (calc)
EXAMPLE	EI-01	Hosting provider's ISO/IEC 27001 certificate and scope statement	Certificate	CS-5	The hosting provider's certification body	Head of IT	15 Nov 2023	14 Nov 2026	Public		SUP-002	permitted	Current	The provider's, for its hosting service. Renewal audit expected before the expiry date.	45	Expiring	Complete	Questionnaire response lead	Send to anyone
EXAMPLE	EI-02	Penetration test report, online ordering service, March 2026	Audit report	CS-2	An independent testing firm	Head of IT	27 Mar 2026	26 Mar 2027	Summary only	EI-03			Current	Holds exploit detail. Only the summary leaves.	177	In date	Complete	Head of Information Security	Summary EI-03 in its place
EXAMPLE	EI-03	Penetration test summary, online ordering service, March 2026	Penetration test summary	CS-2	An independent testing firm	Head of IT	3 Apr 2026	26 Mar 2027	Under NDA				Current	The report that stays under a non-disclosure agreement.	177	In date	Complete	Head of Information Security	Send only with an NDA in force
EXAMPLE	EI-04	Information security policy, signed-off summary	Policy extract	CS-1	Executive Committee	Head of Information Security	15 Jan 2026	15 Jan 2027	Public				Current	Approved by the Executive Committee at P04's Policy tier.	107	In date	Complete	Questionnaire response lead	Send to anyone
EXAMPLE	EI-05	Data-flow diagram, online ordering service (high level)	Architecture diagram	CS-2	Head of IT	Head of IT	12 May 2026	11 May 2027	Under NDA				Current		223	In date	Complete	Head of Information Security	Send only with an NDA in force
EXAMPLE	EI-06	Cyber insurance certificate	Insurance certificate	CS-1	The insurer	Head of Risk	1 Apr 2026	31 Mar 2027	Under NDA				Current		182	In date	Complete	Head of Information Security	Send only with an NDA in force
EXAMPLE	EI-07	Recovery test attestation, online ordering service, June 2026	Attestation letter	CS-2	Head of IT	Head of IT	30 Jun 2026	29 Jun 2027	Under NDA				Current	Signed by the Head of IT.	272	In date	Complete	Head of Information Security	Send only with an NDA in force
EXAMPLE	EI-08	Incident response exercise summary, March 2026	Attestation letter	CS-1	Head of Information Security	Head of Information Security	25 Mar 2026	18 Mar 2027	Under NDA				Current	The exercise took place on 2026-03-18.	169	In date	Complete	Head of Information Security	Send only with an NDA in force
EXAMPLE	EI-09	Internal control test results	Audit report	CS-1	Head of Information Security	Head of Information Security	15 Sep 2026	14 Sep 2027	Never shared				Current	Internal workpapers (P20). Never leave the organisation.	349	In date	Complete	Nobody: not released	Not sent: never shared

Release Check

What may go to each recipient

Enter the send date, then each recipient and the dates of the non-disclosure agreement in force. Each row of the Evidence Index shows as Send, a summary in its place, or Not sent with the reason. Ask Legal to confirm that an agreement covers the recipient and the document. This sheet does not record the release (EV-12).

When, and to whom

Recipient (a customer, or a prospect in a live opportunity)	Retail group	Hospital group	Regional public body	Convenience-store chain
Date the evidence is sent	30 Sep 2026	EXAMPLE: 30 Sep 2026. Type a date, never a formula.
Tracker reference	C-01	C-02	C-03	C-04
Non-disclosure agreement in force from (blank for none)	3 Mar 2025		10 Feb 2026	4 Nov 2024
Last day of the agreement (blank for no end date)			9 Feb 2029	3 Nov 2027

What may go

Item ID	Item	Sharing tier	Retail group	Hospital group	Regional public body	Convenience-store chain
EI-01	Hosting provider's ISO/IEC 27001 certificate and scope statement	Public	Send, and say it expires soon	Send, and say it expires soon	Send, and say it expires soon	Send, and say it expires soon
EI-02	Penetration test report, online ordering service, March 2026	Summary only	Summary EI-03 in its place	Summary EI-03 in its place	Summary EI-03 in its place	Summary EI-03 in its place
EI-03	Penetration test summary, online ordering service, March 2026	Under NDA	Send	Not sent: no NDA in force	Send	Send
EI-04	Information security policy, signed-off summary	Public	Send	Send	Send	Send
EI-05	Data-flow diagram, online ordering service (high level)	Under NDA	Send	Not sent: no NDA in force	Send	Send
EI-06	Cyber insurance certificate	Under NDA	Send	Not sent: no NDA in force	Send	Send
EI-07	Recovery test attestation, online ordering service, June 2026	Under NDA	Send	Not sent: no NDA in force	Send	Send
EI-08	Incident response exercise summary, March 2026	Under NDA	Send	Not sent: no NDA in force	Send	Send
EI-09	Internal control test results	Never shared	Not sent: never shared	Not sent: never shared	Not sent: never shared	Not sent: never shared

Counts for each recipient

Items that can be sent as they are	7	2	7	7
Items that go as a summary in their place	1	1	1	1
Items not sent	1	6	1	1
Items to fix first	0	0	0	0
In words	7 of 9 items can be sent as they are; 1 go as a summary; 1 are not sent	2 of 9 items can be sent as they are; 1 go as a summary; 6 are not sent	7 of 9 items can be sent as they are; 1 go as a summary; 1 are not sent	7 of 9 items can be sent as they are; 1 go as a summary; 1 are not sent

Counts of items, never a share. An item that expires inside the warning window goes with a reminder to say so and to renew it (EV-09).

Index Counts

Settings and counts

Set the two yellow cells, then read the counts. Each count is a number with the others named: no score and no percentage.

Settings

As-at date: the date the index is checked at	30 Sep 2026	Expiry is worked out at this date. EXAMPLE: 30 Sep 2026. Type a date, never a formula.
Days before expiry that an item counts as expiring (EV-09)	60	A house default. Your policy states your value (EV-09).

Counts for the report

Count	Number	Which items
Items in the index	9
Items withdrawn	0
Items not withdrawn	9
Sharing tier: Public	2
Sharing tier: Under NDA	5
Sharing tier: Summary only	1
Sharing tier: Never shared	1
Type: Certificate	1
Type: Audit report	2
Type: Penetration test summary	1
Type: Policy extract	1
Type: Architecture diagram	1
Type: Insurance certificate	1
Type: Attestation letter	2
Items past their expiry date, not withdrawn	0
Items that expire within the warning window, not withdrawn	1
Items expired or expiring (QM-04)	1	EI-01
Items that are a supplier's document (EV-11)	1
of which the supplier's terms do not allow sharing	0
Items with a field to fix (EV-08)	0	None

In words (for the report)

9 items in the index: 2 Public, 5 Under NDA, 1 Summary only and 1 Never shared; 0 withdrawn.

1 item is expired or expiring within 60 days: EI-01 (QM-04).

Supplier's documents: 1 of 9 items (EV-11).

Every item has the fields EV-08 asks for.

QM-04 is the measure of this index. QM-01 to QM-03 and QM-05 come from the tracker and the answer library.

Types and Rules

Types, sharing tiers, scopes of claim and rules

The lists the Evidence Index uses, and the rules EV-08 to EV-14. Use the words exactly: the checks read them.

Evidence types (EV-01 to EV-07)

ID	Type	What it is	P06 evidence item	What to check about its scope
EV-01	Certificate	A certificate issued by a certification body for a management system or a service, with its scope statement.	P06 EV-02	Check the scope names the service, the sites and the legal entity that holds it.
EV-02	Audit report	A report by an independent auditor or tester on the organisation or a service, for a named period.	P06 EV-03	Check the period, the service covered and who commissioned it.
EV-03	Penetration test summary	A short document by the tester or the owner that says what was tested, when, by whom, and how findings were handled.	P06 EV-06	Check the systems and the date. A summary never replaces the report for the owner.
EV-04	Policy extract	The signed-off summary or an extract of a policy, with its approver and date.	P06 EV-05	A policy shows what is required. It does not show that it is met.
EV-05	Architecture diagram	A high-level diagram of a service and its data flow.	None	Send the high-level version only. Detail stays inside.
EV-06	Insurance certificate	A certificate of an insurance policy, with the insurer, the cover and the period.	None	State the cover as the certificate states it.
EV-07	Attestation letter	A signed statement by a named person of a fact they have checked, such as a recovery test result, with its date and scope. A bridge letter is an attestation that covers the gap after a report period.	P06 EV-04	It covers what its signer checked, on its date, and nothing else.

Sharing tiers

Tier	Rule	Released by
Public	May be sent to a customer or prospect with no further agreement.	Questionnaire response lead
Under NDA	May be sent only where a non-disclosure agreement covers the recipient on the day it is sent.	Head of Information Security
Summary only	The item itself is never sent. Its approved summary, named in the index, is sent in its place.	Head of Information Security
Never shared	Not sent outside the organisation. A change of tier is a decision of the Head of Information Security and Legal.	Nobody. A change of tier is a decision of the Head of Information Security and Legal.

Scopes of claim (CS-1 to CS-7)

ID	Scope	What it means
CS-1	Whole company	True of the whole organisation, as the answer says.
CS-2	Named service	True of one named service, such as the online ordering service, and no other.
CS-3	Named site	True of named sites, such as the three warehouses, and no other.
CS-4	Named system or tool list	True of the systems or tools named, or on the list as at the date shown.
CS-5	Supplier's service, not ours	True of a supplier's service. The supplier, not the organisation, holds the control and the attestation.
CS-6	Written policy only	What the organisation's written policy requires. The answer does not say that every case meets it.
CS-7	Plan with a date	A plan that is not yet in place, stated with its date. It is never worded as present.

Rules for the index (EV-08 to EV-14)

ID	Rule
EV-08	Every item has a type, a scope of claim, an issuer or signer, an owner, an issue date, an expiry date (or the word None), a sharing tier and, where it is a supplier's, the supplier and its terms.
EV-09	An item with an expiry date is renewed before it expires. The owner is reminded [[60]] days ahead, and the response lead lists every item that expires inside that window.
EV-10	An item that expired, or was withdrawn, is not sent. The answers that cite it are held until the owner renews it or changes the answers.
EV-11	A supplier's certificate or report is shared only if the supplier's terms allow it, and is labelled as the supplier's, with its scope. It is never shown as the organisation's own (QG-14).
EV-12	Evidence is released by its tier and by the person that tier names (QG-13). The release is recorded in the tracker with the item, the recipient and the date.
EV-13	A recipient with no non-disclosure agreement in force is offered Public items, and a summary whose own sharing tier is Public. The request for an agreement goes to Legal.
EV-14	An item is described to a customer by its title, scope, issuer and dates, as the document states them, and no further.

Where the other documents fit

Topic		What to know
The answers that cite an item		The Security Answer Library holds the answers. Each cites the item IDs of this index, or says Statement only (AL-04, QG-06). An answer whose item has expired is held until its owner renews the item or changes the answer (EV-10).
Recording a release		The Questionnaire Request Tracker records the item, the recipient and the day (EV-12, RT-12). This workbook says what may go. It does not record what went.
A wrong item sent		An item sent by mistake, or an expired one, is a wrong answer. The correction route of the Questionnaire Response Governance Method applies (QG-19). Do not hide it.
Suppliers' certificates		P06 owns how you assess and monitor your own suppliers and how you validate what they send you (P06 TP-04). This index holds a supplier's document only so that you can show it, as theirs, when their terms allow (QG-14, EV-11).
Keeping the response		The exact response as sent, with the item versions it cited, is kept for the records period (QG-16, P22).
A document that says the organisation is certified		Say so only when the index holds a current document that says it for the scope stated, and Legal has confirmed the wording (QG-10). The EXAMPLE holds no certificate of its own.

The CSA STAR registry, SOC 2 reports and ISO/IEC certificates are named by their publishers. A document in this index is evidence about its own scope and period only.

Lists

ListType	ListScope	ListTier	ListStatus	ListTerms	ListSupplier	ListSupplierName
Certificate	CS-1	Public	Current	permitted	SUP-001	SUP-001 Managed IT service provider
Audit report	CS-2	Under NDA	Withdrawn	not permitted	SUP-002	SUP-002 Cloud hosting provider
Penetration test summary	CS-3	Summary only			SUP-003	SUP-003 Payment service provider
Policy extract	CS-4	Never shared			SUP-004	SUP-004 ERP software provider (hosted)
Architecture diagram	CS-5				SUP-005	SUP-005 Email and office software provider
Insurance certificate	CS-6				SUP-006	SUP-006 Security monitoring provider
Attestation letter	CS-7				SUP-007	SUP-007 National parcel carrier
					SUP-008	SUP-008 Express courier
					SUP-009	SUP-009 Pallet network
					SUP-010	SUP-010 Warehouse management system provider
					SUP-011	SUP-011 Backup service provider
					SUP-012	SUP-012 Payroll bureau
					SUP-013	SUP-013 Outsourced customer contact centre
					SUP-014	SUP-014 Network connectivity provider

Definitions

Definitions

Term	Meaning in this workbook
Evidence	A document that supports an answer: a certificate, an audit report, a penetration test summary, a policy extract, a diagram, an insurance certificate or an attestation letter.
Attestation	A signed statement by a named person of a fact they have checked, such as the result of a recovery test, with its date and scope.
Sharing tier	The rule for who may receive an evidence item: Public, Under NDA, Summary only or Never shared.
Non-disclosure agreement (NDA)	A non-disclosure agreement that covers the recipient and the document, in force on the day the document is sent.
Scope of claim	What an answer covers: the whole company, a named service, a named site, a named system or tool list, a supplier's service, a written policy only, or a plan with a date. An answer never implies a wider scope than its evidence has.
Stale	A library answer whose review date has passed. A stale answer is not sent until its owner has confirmed or changed it.
Questionnaire response lead	The person who owns a request from receipt to close, keeps the library, the evidence index and the tracker, and releases responses.
Topic owner	The manager who runs the control an answer describes, and who writes or confirms answers on that topic.
Item	One row of the index: one document you may show a customer, with an ID of the form EI-nn.
Summary only	The tier of a document that is never sent itself. Its approved summary, which has a row of its own, is sent in its place.
Supplier's document	A certificate or report that belongs to a supplier. It is shared only as the supplier's terms allow, and labelled as theirs (EV-11).
As-at date	The date the index is checked at, typed on the Index Counts sheet.
Warning window	The days before the expiry date within which an item counts as expiring (EV-09). The last day of the window counts.
Days to expiry (calc)	The expiry date less the as-at date. Negative once it has passed. Blank where there is no expiry date.
Expiry (calc)	Withdrawn, No expiry, Expired (the expiry date is before the as-at date), Expiring (within the warning window of the as-at date, counting the last day) or In date.
Fields to fix (calc)	Complete, or the fields EV-08 asks for that are empty or wrong: the ID, name, type, scope of claim, issuer, owner, issue date, expiry date, sharing tier, summary item, supplier's terms and status.
Released by (calc)	The role that releases an item of its tier (QG-13). Never shared items are not released.
Goes out as (calc)	What happens to the item, before you know the recipient: Send to anyone, Send only with an NDA in force, the summary in its place, or Not sent with the reason. The Release Check sheet gives the answer for a named recipient.
Expired or expiring (calc)	1 for an item that is not withdrawn and whose expiry date is on or before the last day of the warning window. This is the count of QM-04.
EI-nn, EV-nn, CS-n, QG-nn, QM-nn	Item IDs, evidence types and rules, scopes of claim, requirements of the Questionnaire Response Governance Method and measures. The other documents of this pack use the same IDs.
EXAMPLE	A worked example: the distributor as at 30 Sep 2026. Every name and value is made up. Delete before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 7.5 — Documented information	Evidence Index sheet: the index is documented information, identified, dated, owned and kept current
NIST CSF 2.0	GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed”	Evidence Index sheet: the evidence you hold and may share shows what customers and others can expect of your cybersecurity risk management
NIS2 — Directive (EU) 2022/2555	Article 21(3) — measures take into account each direct supplier's specific vulnerabilities and the overall quality of its products and cybersecurity practices, including secure development	Evidence Index sheet: a customer that is an essential or important entity takes the quality of your practices into account. The index lists what you can show, with its scope and dates
DORA — Regulation (EU) 2022/2554	Article 30(3)(e) — contracts for ICT services supporting critical or important functions include the right to monitor the provider’s performance on an ongoing basis, with unrestricted rights of access, inspection and audit by the financial entity or an appointed third party and by the competent authority, the right to agree alternative assurance levels where other clients’ rights are affected, the provider’s obligation to cooperate fully during on-site inspections and audits by the authorities, the Lead Overseer, the entity or an appointed third party, and details of the scope, procedures and frequency of audits	Release Check sheet: a financial entity customer may ask for more. Report-based assurance is the default offer, and Legal decides what else
GDPR — Regulation (EU) 2016/679	Article 28(5) — adherence of a processor to an approved code of conduct (Article 40) or an approved certification mechanism (Article 42) “may be used as an element by which to demonstrate sufficient guarantees”	Evidence Index sheet, Type and Scope of claim columns: a certificate or code of conduct may be used as an element in showing guarantees, and shows only what its scope states
GDPR — Regulation (EU) 2016/679	Article 32(3) — adherence to an approved code of conduct (Article 40) or an approved certification mechanism (Article 42) “may be used as an element by which to demonstrate compliance with the requirements set out in paragraph 1” of Article 32	Evidence Index sheet, Issued and Expires columns: a certification mechanism may be used as an element in showing security, for the period it covers
ENISA, Procurement guidelines for the cybersecurity of hospitals and healthcare providers (July 2026)	Measure SOURCE-01 asks hospitals, when feasible, to prioritise suppliers “who demonstrate certified compliance with relevant security standards and regulations”; its checks include criteria that “prioritise suppliers with certified or independently assessed security postures” and an assessment of the supplier's incident response plans	Evidence Index sheet: a customer that follows this measure prefers suppliers with certified or independently assessed postures, and asks for the document and its scope
UK NCSC, Supply chain security guidance	Principle 10, “Build assurance activities into your supply chain management” — “Build the 'right to audit' into all contracts and exercise this.” It adds that this “might not always be possible or desirable, particularly where this relates to a Cloud service”, and that, where justified, a buyer builds in assurance requirements such as penetration tests, external audit or formal security certifications	Evidence Index and Release Check sheets: assurance such as penetration tests, external audit and certifications is offered as reports and summaries. A right to audit goes to Legal
Cloud Security Alliance (CSA)	CSA STAR (Security, Trust, Assurance and Risk): “a publicly accessible registry that documents the security and privacy controls provided by popular cloud computing offerings”. Level 1 is a self-assessment that submits the CAIQ. Level 2 builds on third-party audits: a STAR Certification for ISO/IEC 27001, whose certificates “expire after three years unless updated”, and a STAR Attestation for SOC 2, whose listings “will expire after one year unless updated”. CSA says publishing to the registry can help “alleviate the need to fill out multiple customer questionnaires”	Evidence Index sheet, Expires column: STAR certifications and attestations expire, so the index tracks the dates
AICPA, SOC 2	SOC 2® Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy (AICPA). Cited by name and title only; no criterion is quoted, and a SOC 2 report is evidence about the service organisation and the period it names	Evidence Index sheet, Scope of claim and Issued columns: a report is evidence about the service organisation and the period it names

Editions referenced: Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); CSA CCM, CAIQ and STAR, the Shared Assessments SIG, and SOC 2 (by name and title only), as their publishers state them; as published and read on 9 October 2026

Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 21(2)(d) and 21(3) ask a customer that is such an entity to manage the security of its direct suppliers and service providers, and to take into account the quality of their cybersecurity practices. They bind the customer. They do not give it a right to an answer from you. ENISA's guidance for hospitals says the Directive does not directly impose requirements on ICT suppliers and that its obligations take effect through national law. A questionnaire is the customer's way of meeting its own duty, and what you owe it comes from your contract. A supplier that is itself an essential or important entity has its own Article 21 duties, which this pack does not restate.

Regulation (EU) 2022/2554 binds the financial entities of its Article 2. Articles 28 to 30 say what a financial entity does about ICT third-party risk and what its contract with an ICT third-party service provider holds. A provider is bound to them through that contract. Article 30(3) asks for more where the service supports a critical or important function of the financial entity. A customer that is not a financial entity cannot rely on Article 30 to ask the same of you. Counsel confirms whether a customer is a financial entity and whether a service supports a critical or important function of it.

Regulation (EU) 2016/679 binds controllers and processors. Where you process personal data on a customer's behalf you act as its processor, and Article 28(3) sets what the contract holds, including information to show compliance and audits. Where you decide the purposes and means yourself, you are a controller of that data. The role depends on the facts for each processing, and counsel confirms it. Article 32 asks both roles for security that is appropriate to the risk.

ENISA's guidance and the NCSC's principles are guidance for buyers. They are not law, and they do not say what the contract between you and a customer must hold. ENISA says its publication does not endorse a regulatory obligation.

The CSA CAIQ, CCM and STAR, the Shared Assessments SIG and the certificates and reports a customer may ask for are industry practice and voluntary guidance. They are not law. No law named here requires you to complete a customer's form, and completing one, or holding a certificate or report, is not a statement that you comply with NIS2, DORA, the GDPR or any standard. This pack cites each as its publisher states it.

This pack does not say which certificate, report or form meets a requirement of NIS2, DORA or the GDPR. Each reference says what its source asks of the customer or the provider and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, DORA or the GDPR, or that your organisation holds a certificate.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.