Questionnaire Intake, Drafting & Approval Procedure

Purpose

This procedure sets out how [[Organisation Name]] runs a customer's security questionnaire from the day it arrives to the day it is closed. It answers one question for the people who receive, draft and approve responses: can this go to the customer? The route is the same for a short email, a standard form, a call and the security schedule of a contract.

It applies the Questionnaire Response Governance Method. It sets what happens at each of nine steps, who does it, what evidence the file holds, who approves each kind of answer, who may release each piece of evidence, and what to do when an answer turns out to be wrong.

A questionnaire answer is a statement the organisation is held to. A customer reads it as a description of what the organisation does, relies on it when it decides to buy, and may point to it later if something goes wrong. So the organisation answers once, from an approved source, with evidence behind it, and says what the answer covers. A form is not the place to agree a new commitment. Promises are made in the contract, through a standard schedule and a short ladder of approvals, and an answer never promises what the contract or the controls do not support. The result is counts of requests answered on time, answers reused, evidence in date and commitments kept. It is never one score.

Legal note

This document helps you answer security questionnaires from your customers. It is not legal advice, and an answer, a certificate or a schedule from this pack is not a statement that you comply with NIS2, DORA, the GDPR or any standard. A response is a statement your organisation is held to. Ask counsel to confirm any answer that a customer could treat as a promise or as a legal claim, and whether a customer is a financial entity or an essential or important entity.

This pack does not say which certificate, report or form meets a requirement of NIS2, DORA or the GDPR. Each reference says what its source asks of the customer or the provider and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.

Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 21(2)(d) and 21(3) ask a customer that is such an entity to manage the security of its direct suppliers and service providers, and to take into account the quality of their cybersecurity practices. They bind the customer. They do not give it a right to an answer from you. ENISA's guidance for hospitals says the Directive does not directly impose requirements on ICT suppliers and that its obligations take effect through national law. A questionnaire is the customer's way of meeting its own duty, and what you owe it comes from your contract. A supplier that is itself an essential or important entity has its own Article 21 duties, which this pack does not restate.

The CSA CAIQ, CCM and STAR, the Shared Assessments SIG and the certificates and reports a customer may ask for are industry practice and voluntary guidance. They are not law. No law named here requires you to complete a customer's form, and completing one, or holding a certificate or report, is not a statement that you comply with NIS2, DORA, the GDPR or any standard. This pack cites each as its publisher states it.

ENISA's guidance and the NCSC's principles are guidance for buyers. They are not law, and they do not say what the contract between you and a customer must hold. ENISA says its publication does not endorse a regulatory obligation.

Scope

This procedure applies to every security question a customer or a prospect in a live sales opportunity puts to the organisation. A questionnaire is a set of questions about the organisation's security that a customer or prospect sends before buying, at renewal or after an event. It can be a customer's own form, a standard form such as the CSA CAIQ or the Shared Assessments SIG, a due diligence call, an audit request or the security schedule of a contract.

QG-01 Every security questionnaire, due diligence request, audit request and contract security schedule from a customer or prospect goes through this method. Nobody answers a customer's security question outside it, and that includes a short reply by email or on a call.

P06 covers the questionnaires your organisation sends to its suppliers. This pack covers the ones it receives from its customers and answers as a supplier. P06's tiers, clause library and evidence checklist show what a customer that follows the same model will probably ask for. This pack does not change them. Where this procedure says a customer will probably ask for what P06 asks of its own suppliers, it reads P06 and does not change it.

It does not decide whether an event is a security incident. That is the incident response pack (P09). The reporting duties and their clocks are in the Regulatory Incident Notification & Reporting pack (P18). This procedure states no clock of its own for telling a customer of an incident.

Roles

Three rules about people apply throughout. The account owner writes and approves no security answer. Nobody approves an answer they wrote: the next level takes their place (Step 7). Nobody confirms an answer about a control they do not run.

QG-02 Only the questionnaire response lead and the topic owners the library names enter an answer. The account owner manages the relationship and sends only what the response lead has released. Nobody in sales writes a security answer.

The nine steps

Every request goes through the same nine steps. A short request with Current answers passes through them in a day or two. A long form with stale and new answers takes longer and has more people in it.

The steps run in order for each answer. Different answers in one response can be at different steps at the same time. The response goes out when every answer has passed Step 7.

Step 1: Receive and log

IN-01 Log every request in the tracker (A07) the day it arrives, whoever receives it, with one response lead. Triage it within [[2]] working days of receipt.

In practice. Whoever receives a request logs it in the tracker the same day: an email, a portal message, a point in a call or a security schedule in a draft contract all count. Enter the customer, the kind of request, the day it reached anyone, the date the customer gave and where the original is stored. Name one response lead. If the request reached sales, the account owner passes it on and answers nothing. Keep the customer's file in the tracker's store, not in a shared mailbox. Leaves: A tracker entry (RT-01 to RT-07) and the original request, kept as received.

QG-15 A customer's questionnaire and the reply are Confidential. They are kept in the tracker's store and sent only through the customer's channel or an encrypted route. An answer to one customer carries no other customer's name, data or terms.

Step 2: Triage

In practice. Within the triage window the response lead decides whether to answer at all, then how. Check who sent it, whether the same customer or form was answered inside the reuse window, how many questions have a Current library answer, how many a stale one and how many none, and whether the request asks for an audit, for access or for contract terms. Then choose one of three decisions and write down why. Leaves: The decision and its reason, the three counts and the routes (RT-08, RT-09).

The three decisions

IN-09 Decide one of three: answer in full, point to a certificate or the overview, or decline. Record the decision and the reason.

IN-04 Answer a customer, or a prospect in a live sales opportunity. Decline a request from anyone else and record why. Sales may send the Public overview and Public evidence.

What triage finds, and what follows

Run the checks below on every request. Each row has been run through the triage method of the pack, so the table agrees with the worked cases at the end.

IN-02 Before drafting, look in the tracker for a response to the same customer, or on the same standard form, in the last [[12]] months. If the library answers behind it are still Current, reuse that response and tell the customer what has changed.

IN-06 Prefer the overview and the evidence pack to a long form. A customer's form is answered as it comes, in its own format, without retyping the questions. A form above the largest standard set, about 60 questions in P06, is first offered the overview and the evidence.

IN-07 A request for an audit, a visit or access to systems goes to Legal. The default offer is report-based assurance (SC-03).

IN-08 Count reuse at triage, as counts: how many of the questions have a Current library answer, how many a stale one, and how many none.

Reuse is a count. Write it as "198 of 300 questions can be answered from current library answers", never as a share of the form. A reused response is still checked against the library on the day it is sent: a library answer that has gone stale since is not reused as it stands.

A form with more than about 60 questions is longer than the largest standard set that P06 gives a buyer. That is a reason to offer the overview, not a reason to refuse the form.

Step 3: Plan and agree the date

IN-03 Agree the due date with the customer. If fewer than [[5]] working days remain and answers must be confirmed or written, agree a later date before work starts (QG-18).

In practice. Turn the counts into a plan. A library answer that may go out as it stands (Current, Review due or Evidence expiring) needs only release. Each stale answer needs its topic owner. Each unmatched question needs a topic owner to write it and the Head of Information Security to approve it. Compare the working days left with the work. Where too few remain, the account owner agrees a later date with the customer before work starts and the response lead records the new date and the reason. Leaves: The agreed due date (RT-05), the plan by kind of answer and the topic owners asked.

IN-10 Plan the approvals at triage from the count of each kind of answer, and name the topic owners who must confirm stale answers.

IN-05 Scope what is asked: the service, the sites and the data the contract covers. A question about a system the customer does not use is answered by saying so, not by describing it.

QG-18 A request that cannot be met by its due date is renegotiated with the customer before that date, with a reason and a new date, and the change is recorded. A request is never left to lapse.

Three plans come out of triage. A library answer that can go out as it stands (Current, Review due or Evidence expiring) is released by the response lead. A stale answer, or a usable one the customer's wording does not quite fit, becomes an adapted answer that its topic owner confirms. A question with no match becomes a new answer that the topic owner writes and the Head of Information Security approves. Count each kind and write the three counts in the plan.

Step 4: Draft from the library

QG-05 Use the library answer unchanged when its state lets it go out as it stands (Current, Review due or Evidence expiring). Change an answer in the library first, with its owner's approval, and then use it. Do not edit an answer inside a customer's form.

In practice. Work in the customer's own format and do not retype its questions. For each question, find the matching library answer and use it unchanged if its state lets it go out as it stands (Current, Review due or Evidence expiring). Where the words must change, change the library first: enter the adapted answer as a new or changed entry, take its owner's confirmation, then use it. Mark a question with no match as unmatched and route it to the topic owner. A drafting tool may suggest from the library only, and only if it is on the approved list for the data it sees. Leaves: A draft in which every answer carries a library ID, or is marked adapted or new.

The library gives each answer a state on the day. Only some states may go out as they stand.

A review date is [[12]] months after the last review, and [[6]] months for incident notice and AI. An answer is due for review inside the 30 days before its date, and evidence is expiring inside the [[60]] days before its expiry date.

QG-22 A tool, including an AI assistant, may suggest a draft only from the library and only if it is on the approved list for the data it sees (P24). A drafted answer is a new or adapted answer and takes its approval. A customer's questionnaire is not put into a tool that is not approved for Confidential data.

Step 5: Get the topic owner's input

QG-04 A topic owner, the person who runs the control, writes or confirms every answer that is not already in the library. Nobody confirms an answer about a control they do not run.

In practice. The topic owner, the person who runs the control, confirms each stale answer and writes each unmatched one. Every answer states what it covers (one scope of claim) and cites evidence from the index or says it is a statement only. An answer about AI is confirmed by the AI governance lead against the inventory. An answer about telling customers of an incident points to the incident rules and the standard schedule, and gives no period of its own. If the owner is unsure that a control works for the scope asked, narrow the scope or state a dated plan. Leaves: The answer, its scope of claim, its evidence reference and its owner.

QG-07 Every answer says what it covers: the whole company, a named service, a named site, a named system or tool list, a supplier's service, a written policy only, or a plan with a date. An answer never implies a wider scope than its evidence has.

Choose the narrowest scope the evidence supports. A control in place at one service is a control at that service. A written policy shows what the organisation requires and does not show that every case meets it.

QG-10 Name a certificate by its exact title, scope, issuer and dates, and say whose it is. Say that the organisation is certified, compliant or aligned only when the evidence index holds a current document that says it for the scope stated and Legal has confirmed the wording. A supplier's certificate is never presented as the organisation's own.

QG-20 An answer about the organisation's use of AI comes from the AI inventory and the reviews behind it (P24, P25) and is confirmed by the AI governance lead. It states no risk category and no role under any law.

Where the question is about incident notice, the answer points to the organisation's incident notification rules and to the period in the standard schedule. It states no period of its own, and it promises no notice those rules do not provide.

Step 6: Check

QG-09 A form is not a contract. An answer creates no commitment. A commitment is made only through the standard schedule (A09) and its ladder. A promise found in an answer, such as a date, an action, an absolute word, a right of audit or access, or a liability, goes to Legal before the response is sent.

In practice. The response lead runs the whole draft through the response quality and over-commitment checklist. Each flag turns the answer into a kind that needs a higher approver. Fix the wording first where the fix is plain: drop an absolute word, name the service, replace a period with a pointer to the schedule. Then re-run the check. A flag the approver clears is cleared in writing, and stays cleared only for the same words. Leaves: The checklist result as counts: flags raised, reworded and cleared, and who cleared each.

QG-11 Run the response quality and over-commitment checklist (A06) on every response before it goes out. The approver that the kind of answer sets clears each flag, in writing.

The checklist has eight checks. Each looks for a kind of wording that makes a promise or a claim the controls may not support. A flag does not mean the answer is wrong. It means the answer needs a higher approver than its kind alone would.

The words each check looks for are in the Response Quality & Over-Commitment Checklist, which runs them for you. Reword before you ask for a clearance: an answer that says what is true, for a named scope, with evidence, seldom needs one.

Step 7: Approve

QG-08 The approver follows the kind of answer. The response lead releases a library answer. The topic owner confirms an adapted answer. The Head of Information Security approves a new answer. Legal and the Head of Information Security approve a contractual commitment and a legal or regulatory claim. Nobody approves an answer they wrote: the next level takes their place.

In practice. The kind of answer sets the approver. Nobody approves an answer they wrote: the next level takes their place. The response lead records each approval against the answer, in the tracker. An answer that needs Legal waits for Legal. Do not send part of a response while a flagged answer is open without telling the customer which answers follow. Leaves: An approval for every answer that is not a library answer sent as it stands: name, role, date.

The response lead releases every response, whatever the kinds in it. Where the kind raises the approver, the higher approver decides and the lead records it.

When the author is an approver

A person who wrote an answer cannot approve it. The next level takes the place, and the response lead records who was replaced.

QG-12 Every topic and every library answer has a named owner. An answer is reviewed by its review date: [[12]] months after its last review, and [[6]] months for incident notice and AI. A stale answer is not sent until its owner has confirmed or changed it.

An answer that is approved is entered in the library with its owner, its scope of claim, its evidence reference and its review date. An adapted or a new answer is checked again whenever its words change.

Step 8: Release evidence and submit

QG-13 Release evidence by its sharing tier. The response lead releases Public items. The Head of Information Security releases Under NDA items once a non-disclosure agreement covers the recipient, and releases a Summary only item as its approved summary and nothing more. A Never shared item is not released. Evidence past its expiry is not sent.

In practice. Release each evidence item by its sharing tier, on the day of sending, and check its expiry date. Add the covering statement. The account owner sends the response through the customer's channel or an encrypted route, and sends only what the response lead has released. The response lead records the evidence sent, the recipient and the day. Leaves: The submitted date (RT-10), the evidence sent (RT-12) and an exact copy of the response as sent (RT-13).

QG-14 A document that belongs to a supplier, such as a certificate or a report, is shared only as that supplier's terms allow, and is described as the supplier's.

Before an item goes, check its expiry date on the day, and check that a non-disclosure agreement is in force for the recipient if the tier needs one. Say in the response when an item expires within [[60]] days. Say that it is being renewed only if its owner has confirmed that. A recipient with no agreement in force is offered the Public items and a summary whose own tier is Public, and the request for an agreement goes to Legal. Describe an item by its title, scope, issuer and dates as the document states them, and no further.

The covering statement

Every response starts with the same statement. Legal confirms the wording once, for the whole library.

These responses describe [[organisation]] as at [[date of response]], for the scope each answer states. They are given in good faith to help [[customer]] assess its supplier. They do not change the agreement between us. A commitment is made only in the agreement or in a schedule that both parties have signed.

Step 9: Follow up and close

In practice. Log every commitment made in or around the response, with an owner, a date and what supports it. Add the new and adapted answers to the library. Answer the customer's follow-up questions by going back to Step 4. Close the request when nothing is open. Report the month's counts to leadership. If a wrong answer comes to light at any point, use the correction route. Leaves: The commitments (RT-11), the library changes, the closed status and the month's counts.

QG-17 Log every commitment made in or around a response, with an owner, a due date and what supports it. The response lead reports open commitments and those past their due date every month.

A commitment is a promise to do something or to provide something, with a date or a continuing duty. Log it with these fields, whether it sits in an answer, in a covering email or in a call:

• The words, as the customer received them, and the day.
• The owner, and the due date or the word Continuing.
• What supports it: a contract clause, a control in place, an approved plan, or none. A commitment with none is not sent. Take it out, or send it to Legal.

QG-16 Keep an exact copy of every response as sent, its approvals, the evidence versions it cited and its covering statement, for [[3]] years after the relationship ends, or longer where a contract or a law asks (P22).

What the file holds

• The customer's request as received, and the tracker entry.
• The response exactly as sent, with its covering statement.
• The approvals: name, role and date, for every answer that is not a library answer sent as it stands.
• The checklist result and who cleared each flag.
• The evidence versions cited and the evidence sent, with the recipient and the day.
• The commitments logged, and any correction made later.

What the response lead reports each month

Five counts, none of them a score. Each is "n of m" or a plain count, and each is read with the list behind it.

When an answer is wrong

QG-19 A wrong answer is withdrawn from the library at once, every response that used it is found, and the customer is told by the correction route in this method. A material correction reaches the customer within [[5]] working days of the error being confirmed.

An answer can be wrong in five ways. The kind decides how serious it is.

An unsupported commitment or an overstated scope is always material. Any other error is material if the customer relied on it or it is written into the contract. Everything else is minor.

A minor correction goes through steps CR-1 to CR-5 and CR-9. A material one goes through CR-1 to CR-4, CR-6 and CR-9. CR-7 is added where the customer relied on the answer or it is in the contract. CR-8 is added where the error shows a control that does not work or exposes personal data.

Common mistakes

Worked example: the distributor's third quarter of 2026

EXAMPLE, not part of the procedure. The organisation used throughout the packs is a wholesale distributor with about 900 staff and three warehouses, an important entity under NIS2 in its Member State, and not a financial entity, so DORA's reporting duties do not apply. Here it is the seller. It sells to business customers: retailers, a hospital group and a regional public body, and they send it questionnaires. The Head of Information Security approved the method on 25 Aug 2026. The Questionnaire response lead owns the method, and nobody approves a document they own (P04 PF-03), so the Head of Information Security approves it at P04's Standard tier. The library was issued on 1 Sep 2026. The answers came from earlier forms and spreadsheets. Each keeps the date its owner last confirmed it, so some are past their review dates. The distributor holds no ISO/IEC 27001 certificate of its own. Its hosting provider holds one for the hosting service. P08's example is a different company, a software firm working towards its first certificate. Values are as at 30 Sep 2026.

On that day the library holds 50 answers: 28 Current, 3 Review due, 3 Evidence expiring, 6 Stale, 9 Draft, 1 Withdrawn; 34 can be sent as they stand.

The seven requests of the quarter

3 of 4 responses went out by their due date; 422 of 576 questions had a current library answer; 6 library answers are past their review date; 1 evidence item expires within 60 days; 0 commitments are past their due date.

Three of these show the routes. R-2026-028 came from marketing platform vendor asking for full security documentation. The sender is neither a customer nor a prospect in a live opportunity (IN-04), so triage declines it. R-2026-030 is an audit request from the convenience-store chain, which asked to visit. The customer accepts the documents and they cover its questions, so the decision is to point to them, and Legal offers report-based assurance (SC-03). R-2026-029 is a contract security schedule from the regional public body. It asks for contract terms, so Legal and the Head of Information Security approve them and are reviewing the customer's wording against the standard schedule.

R-2026-031: the hospital group's questionnaire

The hospital group's own form, 300 questions, at the customer's own portal. It reached the organisation on 14 Sep 2026 and was triaged on 16 Sep 2026, which is 2 working days later. It is due on 16 Oct 2026.

Steps 1 to 3: log, triage and plan

198 of 300 questions can be answered from current library answers. The form has 300 questions, which is well above the 60 in P06, so triage raised IN-06: offer the overview and the evidence first. The customer asks for its own form in its own portal, and the documents do not cover every question, so the decision is Answer in full. Triage routes it to the Questionnaire response lead, Topic owner and Head of Information Security. 22 working days remained at triage, against a minimum of 5, so the date stood.

Steps 4 to 7: five drafts the checklist stopped

While drafting, the team wrote five answers that went further than the controls support. The checklist flagged each one. These are drafts, not answers the organisation gave.

In each case the fix was to say what is true: a supplier's certificate named as the supplier's, a scope narrowed to the online ordering service, a period replaced by a pointer to the schedule, and a right to audit replaced by report-based assurance.

Step 8: what may go to the hospital group today

The non-disclosure agreement is with the customer's lawyers. No agreement covers the recipient today, so the evidence index releases two items now and holds the rest.

The team made one commitment in this request on 16 Sep 2026: CM-05, "We will send the penetration test summary once the non-disclosure agreement is signed". It is owned by the Questionnaire response lead, due on 9 Oct 2026, and supported by a control in place. The tracker shows it as open, and it is not past its date.

Two commitments found in old forms

While it reviewed its old answers for the library, the team found two commitments that no contract or control supported. CM-01 was "We test all systems every six months" in a form of 20 Nov 2025. CM-02 was "We tell all customers of any security incident" in a form of 17 Feb 2026. Both were unsupported commitments, so both were material.

The independent test is once a year and covers the online ordering service. A correction went to the customer, and SA-027 was withdrawn. The notice duties are set by the incident notification rules and the contract, and cover the customers an incident affects. The wording was corrected and the contract schedule is under review (R-2026-029).

The method has the account owner send a material correction, and each commitment is logged as Corrected. The window to tell the customer runs from the day the error is confirmed, and is [[5]] working days. For CM-01 the correction went out on 2 Sep 2026, 5 working days after it was found on 26 Aug 2026. The example records the day CM-02 was found, and not the day it was confirmed.

Related documents

Adapting this template

Framework references

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); CSA CCM, CAIQ and STAR, the Shared Assessments SIG, and SOC 2 (by name and title only), as their publishers state them; as published and read on 9 October 2026.

A reference says what its source asks of the customer or the provider, and which CISO Times document helps with that work. It does not say that an answer, a certificate or a schedule from this pack meets a requirement of NIS2, DORA or the GDPR.

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, DORA or the GDPR, or that your organisation holds a certificate.

Definitions