Questionnaire Request Tracker
Tracks incoming requests, due dates, owners, status and commitments made.
Available soon
- Format
- Excel
- Size
- 161 KB
- Length
- 10 sheets
- Version
- 1.0
- Updated
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | What this workbook is. It is the tracker of Questionnaire Response Governance Method (QG-03, QG-17): one row for each request on the Requests sheet, with the thirteen fields RT-01 to RT-13, and one row for each commitment on the Commitments sheet, with the eight fields CF-01 to CF-08. Thirteen checks (TK-01 to TK-13) run on the rows. The Questionnaire Intake, Drafting & Approval Procedure tells you when to make each entry. |
| 2 | Start on the Summary sheet. Set the as-at date, the period you are reporting and the days that make a commitment due soon. Type the dates, never a formula. The period filters the requests received and answered. Open requests past their due date and open commitments always count every row. |
| 3 | Log each request the day it arrives, whoever receives it (IN-01). Give it an ID in the form R-yyyy-nnn, the customer by reference, the kind and the response lead. Enter the date it reached anyone in the organisation and the due date you have agreed with the customer. Choose the status from the list. |
| 4 | Triage the request within the days the method sets. Enter the counts of its questions: how many have a current library answer, how many a stale one and how many none. The three must add up to the total. Choose the decision: Answer in full; Point to a certificate or the overview; Decline. Give the reason in the note. |
| 5 | Change the status as the work goes on, using one of these: Received; Triaged; Drafting; In approval; Submitted; Follow-up open; Closed; Declined. When the response leaves, enter the submitted date and the reference of the exact copy you keep (QG-16). The Requests sheet then shows whether it went out by its due date. |
| 6 | If a request cannot be met by its due date, agree a new date with the customer before that date, change the due date and say why in the note (QG-18). The request is then due on the new date. Say so when you report. |
| 7 | Log every commitment on the Commitments sheet the day the response leaves, or the day you find it (QG-17). Write it in the words the customer received. Name an owner, a due date or the word Continuing, and what supports it: Contract clause; Control in place; Approved plan; None. A commitment with no support goes to Legal. Enter its CM ID in the Commitments cell of the request. |
| 8 | Read the calculated columns at the right of each data sheet. "Result" names the checks that fail on the row. "State" says whether a request is open, overdue or sent, and whether a commitment is past its due date or due soon. Read the Summary sheet for the check totals, the counts and the sentences for the report. |
| 9 | Report counts with the gaps named, such as "1 open request is past its due date", and no score or share. Report the open commitments, and those past their due date, every month (QG-17). |
| 10 | To clear the EXAMPLE, delete the EXAMPLE rows on the two data sheets once your own are entered. The formulas stay. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Limitations: This document helps you answer security questionnaires from your customers. It is not legal advice, and an answer, a certificate or a schedule from this pack is not a statement that you comply with NIS2, DORA, the GDPR or any standard. A response is a statement your organisation is held to. Ask counsel to confirm any answer that a customer could treat as a promise or as a legal claim, and whether a customer is a financial entity or an essential or important entity.
A request that reports a security incident is not tracked here. It goes to the incident route (P09 IM-01), which decides what it is and whether anything must be reported.
The tracker holds no answer and no customer data beyond a reference. A customer's questionnaire and your reply are Confidential (QG-15): keep them in the store that the copy reference points to, not in this workbook.
The checks read the cells as typed. A date typed as text, a status that is not on the list or an ID in another form is a finding or is ignored. Dates are entered as dates.
EXAMPLE: the distributor, a wholesale distributor with about 900 staff, three warehouses and an online ordering service, as at 30 Sep 2026, reporting the third quarter of 2026. Its tracker holds 8 requests and 6 commitments. 3 of 4 answered requests went out by their due date; 0 open requests overdue; 4 commitments open, 0 past their due date. The checks find no problem.
Adapting this template:
• Small organisation: keep the thirteen request fields and the eight commitment fields. One person may be the response lead for every request, and the same person may own the tracker and the library. The tracker does not depend on how many people you are. It depends on every request being logged on the day it arrives.
• Regulated organisation: add columns to the right of the calculated ones for what your regulator or a customer's contract asks you to record, such as the customer's own reference or the contract clause a request cites. Do not insert columns between the fields, because the checks read them by position.
• Service provider or outsourced IT: if a managed service provider answers a customer's questionnaire for you, log the request here under your own response lead, and record the provider's own reference in the note. A commitment the provider makes for you is yours. Log it as one.
• Replace the [[placeholders]] and the EXAMPLE rows with your own values. Keep the formulas.
• Set the period and the as-at date on the Summary sheet. The days that make a commitment due soon are a house default of the pack: change them there if your own practice differs.
• Rows are limited to the number the formulas cover. To add rows, copy a whole blank row (every column) to the bottom of the table.
This workbook is your own record. Keep a copy that can be reached when the main systems are down.
Summary
Settings, check totals and counts
Set the yellow cells, then read the check totals and the counts. Each count is a number with the others named: no score and no percentage.
Settings
| As-at date: the date the tracker is read at | 30 Sep 2026 | Open requests and commitments are tested at this date. EXAMPLE: 30 Sep 2026. Type a date, never a formula. |
| Period start: the first day reported | 1 Jul 2026 | Requests received on or after this day are counted in the period. EXAMPLE: 1 Jul 2026. |
| Period end: the last day reported | 30 Sep 2026 | Requests received on or before this day are counted in the period. EXAMPLE: 30 Sep 2026. |
| Days that make a commitment due soon | 14 | A house default of the pack (QG-17). Change it to your own practice. |
Check totals TK-01 to TK-13
| Check | What it looks at | Check findings | Result | Where it reads |
|---|---|---|---|---|
| TK-01 (Requests sheet) | Every request has an ID in the form R-yyyy-nnn, and no two requests share one (RT-01). | 0 | No finding | Request ID (RT-01). Duplicates are counted from the second request with the same ID. |
| TK-02 (Requests sheet) | The kind, the status and, once the request is triaged, the decision are each one of the values on the Lists sheet (RT-03, RT-07, RT-09). | 0 | No finding | Kind (RT-03), Status (RT-07) and Decision (RT-09), against the Lists sheet. A decision may be blank only while the request is Received. |
| TK-03 (Requests sheet) | Once a request is triaged, its question counts are whole numbers and the current, stale and unmatched questions add up to the total (RT-08). | 0 | No finding | The four question columns (RT-08). A request that is only Received has no counts yet, and is not checked. |
| TK-04 (Requests sheet) | The received date is present. The due date is present unless the request was declined, and it is not before the received date (RT-04, RT-05; QG-03, QG-18). | 0 | No finding | Received on (RT-04) and Due on (RT-05). |
| TK-05 (Requests sheet) | A response that has gone out has a submitted date that is not after the as-at date. A request that has not gone out has none (RT-10). | 0 | No finding | Status (RT-07), Submitted on (RT-10) and the as-at date. |
| TK-06 (Requests sheet) | The customer and the response lead are named, and a request that has gone out has a copy reference (RT-02, RT-06, RT-13; QG-16). | 0 | No finding | Customer (RT-02), Response lead (RT-06) and Copy reference (RT-13). |
| TK-07 (Requests sheet) | The commitments logged on a request (RT-11) are the commitments on the Commitments sheet that name it. | 0 | No finding | Commitments (RT-11), against the Commitments sheet. It counts the CM IDs in the cell against the commitments that name the request. |
| TK-08 (Commitments sheet) | Every commitment has an ID in the form CM-nn, and no two commitments share one (CF-01). | 0 | No finding | Commitment ID (CF-01). Duplicates are counted from the second commitment with the same ID. |
| TK-09 (Commitments sheet) | The status and the kind of support are each one of the values on the Lists sheet (CF-07, CF-08). | 0 | No finding | Supported by (CF-07) and Status (CF-08), against the Lists sheet. |
| TK-10 (Commitments sheet) | An open commitment names an owner and either a due date or the word Continuing (CF-06). | 0 | No finding | Owner and due date (CF-06) of every commitment whose status is Open. |
| TK-11 (Commitments sheet) | An open commitment has some support: a contract clause, a control in place or an approved plan. A commitment with none goes to Legal before it is kept (QG-09). | 0 | No finding | Supported by (CF-07) of every commitment whose status is Open. |
| TK-12 (Commitments sheet) | The made-on date is present, a due date is not before it, and a corrected commitment has its corrected-on date (CF-05, CF-06). | 0 | No finding | Made on (CF-05), Due on (CF-06) and Corrected on. |
| TK-13 (Commitments sheet) | A commitment made in a request that is in the tracker is listed on that request (RT-11). | 0 | No finding | Request (CF-02), against Request ID on the Requests sheet and its Commitments cell (RT-11). |
A check counts the findings it makes, which can be more than one on a row. The Result column of each data sheet names the checks that fail on a row.
Counts for the report
| Count | Number |
|---|---|
| Requests in the tracker (all rows) | 8 |
| Requests received in the period | 8 |
| Of those, declined | 1 |
| Of those, with a response sent | 4 |
| Of those sent, sent by the due date (QM-01) | 3 |
| Of those sent, sent after the due date | 1 |
| Open requests past their due date (all rows) | 0 |
| Requests with status Received (all rows) | 0 |
| Requests with status Triaged (all rows) | 0 |
| Requests with status Drafting (all rows) | 2 |
| Requests with status In approval (all rows) | 1 |
| Requests with status Submitted (all rows) | 0 |
| Requests with status Follow-up open (all rows) | 0 |
| Requests with status Closed (all rows) | 4 |
| Requests with status Declined (all rows) | 1 |
| Questions in the period's requests that were not declined | 576 |
| Of those, with a current library answer at triage (QM-02) | 422 |
| Of those, with a stale library answer | 67 |
| Of those, with no library answer | 87 |
| Commitments in the log (all rows) | 6 |
| Commitments open | 4 |
| Open commitments past their due date (QM-05) | 0 |
| Open commitments due within the days set above | 1 |
| Commitments Done | 0 |
| Commitments Corrected | 2 |
| Open commitments with no support (TK-11) | 0 |
| Rows with at least one check finding (both sheets) | 0 |
| Check findings in all (TK-01 to TK-13) | 0 |
In words (for the report)
3 of 4 answered requests went out by their due date; 0 open requests overdue; 4 commitments open, 0 past their due date
No open request is past its due date.
No open commitment is past its due date. Due within 14 days: CM-05.
422 of 576 questions had a current library answer at triage (QM-02).
No tracker check has a finding.
QM-01, QM-02 and QM-05 are computed here. QM-03 and QM-04 come from the Security Answer Library and the Evidence & Attestation Library Index.
Requests
EXAMPLE: 8 requests as at 30 Sep 2026. One row for each request. Yellow columns are inputs; white columns calculate.
| Example | RT-01 Request ID | RT-02 Customer (reference) | RT-03 Kind | RT-04 Received on | RT-05 Due on | RT-06 Response lead | RT-07 Status | RT-08 Questions: total | RT-08 Questions: current | RT-08 Questions: stale | RT-08 Questions: unmatched | RT-09 Decision | RT-10 Submitted on | RT-11 Commitments (CM IDs) | RT-12 Evidence sent (EI IDs, with the day) | RT-13 Copy reference | Note (working column) | Row in use (calc) | Received in the period (calc) | Open request (calc) | Overdue (calc) | Sent late (calc) | Working days left to the due date (calc) | Questions with a current library answer (calc) | TK-01 findings (calc) | TK-02 findings (calc) | TK-03 findings (calc) | TK-04 findings (calc) | TK-05 findings (calc) | TK-06 findings (calc) | TK-07 findings (calc) | Check findings on this row (calc) | Result (calc) | State (calc) | Running list of requests past their due date (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | R-2026-024 | C-01 | Questionnaire | 8 Jul 2026 | 31 Jul 2026 | Information Security Manager | Closed | 84 | 68 | 9 | 7 | Answer in full | 28 Jul 2026 | [[where the copy is kept]] | 1 | 1 | 68 of 84 | No finding | Sent by its due date | ||||||||||||||||
| EXAMPLE | R-2026-025 | C-03 | Due diligence call | 21 Jul 2026 | 14 Aug 2026 | Information Security Manager | Closed | 40 | 36 | 2 | 2 | Answer in full | 12 Aug 2026 | CM-04 | [[where the copy is kept]] | 1 | 1 | 36 of 40 | No finding | Sent by its due date | |||||||||||||||
| EXAMPLE | R-2026-026 | C-04 | Questionnaire | 4 Aug 2026 | 28 Aug 2026 | Information Security Manager | Closed | 60 | 52 | 4 | 4 | Answer in full | 27 Aug 2026 | CM-06 | [[where the copy is kept]] | 1 | 1 | 52 of 60 | No finding | Sent by its due date | |||||||||||||||
| EXAMPLE | R-2026-027 | C-01 | Questionnaire | 19 Aug 2026 | 9 Sep 2026 | Information Security Manager | Closed | 52 | 44 | 4 | 4 | Answer in full | 11 Sep 2026 | CM-03 | [[where the copy is kept]] | Late by two working days. The review of the old answers found CM-01 and CM-02. | 1 | 1 | 1 | 44 of 52 | No finding | Sent late | |||||||||||||
| EXAMPLE | R-2026-028 | P-01 | Questionnaire | 2 Sep 2026 | Information Security Manager | Declined | 0 | 0 | 0 | 0 | Decline | An email from a marketing platform vendor asking for full security documentation. Not a customer or a prospect in a live opportunity (IN-04). | 1 | 1 | No finding | Declined | |||||||||||||||||||
| EXAMPLE | R-2026-029 | C-03 | Contract security schedule | 8 Sep 2026 | 2 Oct 2026 | Information Security Manager | In approval | 18 | 10 | 3 | 5 | Answer in full | Legal and the Head of Information Security are reviewing the customer's wording against the standard schedule. | 1 | 1 | 1 | 2 | 10 of 18 | No finding | Open | |||||||||||||||
| EXAMPLE | R-2026-030 | C-04 | Audit request | 15 Sep 2026 | 9 Oct 2026 | Information Security Manager | Drafting | 22 | 14 | 3 | 5 | Point to a certificate or the overview | The customer asked to visit. Legal offers report-based assurance (SC-03). | 1 | 1 | 1 | 7 | 14 of 22 | No finding | Open | |||||||||||||||
| EXAMPLE | R-2026-031 | C-02 | Questionnaire | 14 Sep 2026 | 16 Oct 2026 | Information Security Manager | Drafting | 300 | 198 | 42 | 60 | Answer in full | CM-05 | The hospital group's own form, 300 questions, at the customer's own portal. | 1 | 1 | 1 | 12 | 198 of 300 | No finding | Open |
Commitments
EXAMPLE: 6 commitments as at 30 Sep 2026. One row for each commitment. A corrected commitment keeps its row.
| Example | CF-01 Commitment ID | CF-02 Request or earlier form | CF-03 Customer (reference) | CF-04 Commitment, in the words the customer received | CF-05 Made on | CF-06 Owner (a role) | CF-06 Due on (a date, or Continuing) | CF-07 Supported by | CF-07 Support reference | CF-08 Status | Found wrong on (working column) | Corrected on (working column) | Note (working column) | Row in use (calc) | Open commitment (calc) | Past its due date (calc) | Due soon (calc) | State (calc) | Row of its request in the tracker (calc) | TK-08 findings (calc) | TK-09 findings (calc) | TK-10 findings (calc) | TK-11 findings (calc) | TK-12 findings (calc) | TK-13 findings (calc) | Check findings on this row (calc) | Result (calc) | Running list of commitments past their due date (calc) | Running list of commitments due soon (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | CM-01 | R-2025-061 (a form of November 2025) | C-01 | We test all systems every six months. | 20 Nov 2025 | Head of IT | Continuing | None | Corrected | 26 Aug 2026 | 2 Sep 2026 | The independent test is once a year and covers the online ordering service. A correction went to the customer, and SA-027 was withdrawn. | 1 | Corrected | No finding | ||||||||||||||
| EXAMPLE | CM-02 | R-2026-009 (a form of February 2026) | C-03 | We tell all customers of any security incident. | 17 Feb 2026 | Head of Information Security | Continuing | None | Corrected | 8 Sep 2026 | 15 Sep 2026 | The notice duties are set by the incident notification rules and the contract, and cover the customers an incident affects. The wording was corrected and the contract schedule is under review (R-2026-029). | 1 | Corrected | No finding | ||||||||||||||
| EXAMPLE | CM-03 | R-2026-027 | C-01 | We will send a refreshed security overview in November 2026. | 11 Sep 2026 | Questionnaire response lead | 30 Nov 2026 | Approved plan | [[reference]] | Open | 1 | 1 | Open | 4 | No finding | ||||||||||||||
| EXAMPLE | CM-04 | R-2026-025 | C-03 | We will send the hosting provider's renewed certificate when it is issued. | 12 Aug 2026 | Head of IT | 15 Dec 2026 | Control in place | [[reference]] | Open | P06 monitors the provider's certificate expiry. | 1 | 1 | Open | 2 | No finding | |||||||||||||
| EXAMPLE | CM-05 | R-2026-031 | C-02 | We will send the penetration test summary once the non-disclosure agreement is signed. | 16 Sep 2026 | Questionnaire response lead | 9 Oct 2026 | Control in place | [[reference]] | Open | 1 | 1 | 1 | Due soon | 8 | No finding | , CM-05 | ||||||||||||
| EXAMPLE | CM-06 | R-2026-026 | C-04 | We will confirm the latest recovery test result in the next annual refresh. | 27 Aug 2026 | Head of IT | 30 Jun 2027 | Approved plan | [[reference]] | Open | 1 | 1 | Open | 3 | No finding | , CM-05 |
Lists
| ListKind | ListRStatus | ListDone | ListSent | ListDecision | ListCStatus | ListSupport |
|---|---|---|---|---|---|---|
| Questionnaire | Received | Submitted | Submitted | Answer in full | Open | Contract clause |
| Due diligence call | Triaged | Follow-up open | Follow-up open | Point to a certificate or the overview | Done | Control in place |
| Audit request | Drafting | Closed | Closed | Decline | Corrected | Approved plan |
| Contract security schedule | In approval | Declined | None |
Submitted
Follow-up open
Closed
Declined
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Questionnaire | A set of questions about the organisation's security that a customer or prospect sends before buying, at renewal or after an event. It can be a customer's own form, a standard form such as the CSA CAIQ or the Shared Assessments SIG, a due diligence call, an audit request or the security schedule of a contract. |
| Response | Everything the organisation sends back for one request: the answers, the evidence and any covering statement. |
| Response lead | The person who owns a request from receipt to close, keeps the library, the evidence index and the tracker, and releases responses. |
| Account owner | The sales or customer manager who owns the relationship. The account owner passes on and sends what the response lead releases, and writes no security answer. |
| Commitment | A promise to do something or to provide something, with a date or a continuing duty. A commitment found in an answer is logged, owned and tracked. |
| Contractual commitment | A commitment that a customer could enforce. It belongs in the contract, through the standard schedule or the negotiation ladder, and never in a form. |
| Request | One questionnaire, due diligence call, audit request or contract security schedule from a customer or prospect, tracked from receipt to close. |
| Open request | A request with a known status that is not Submitted, Follow-up open, Closed or Declined, and no submitted date. |
| Overdue | An open request whose due date is before the as-at date. A request that has gone out, or was declined, is never overdue (requestOverdue). |
| Sent late | A response whose submitted date is after the due date (requestLate). |
| Period | The days reported. A request is in the period if it was received in it. The counts of requests received and answered, and the questions, follow the period. |
| Past its due date | An open commitment whose due date is before the as-at date. A commitment marked Continuing has no due date. |
| Due soon | An open commitment whose due date falls from the as-at date to the as-at date plus the days set on the Summary sheet (commitmentsDue). |
| Current, stale, unmatched | At triage, a question has a Current library answer, a stale one or none. The three add up to the total (RT-08, IN-08). |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| RT-nn, CF-nn, TK-nn, QG-nn | Fields of the tracker, its checks and requirements of Questionnaire Response Governance Method. The Questionnaire Intake, Drafting & Approval Procedure and the Response Quality & Over-Commitment Checklist use the same IDs. |
| EXAMPLE | A worked example: the distributor as at 30 Sep 2026. Every name and value is made up. Delete before use. |
The thirteen request fields and the columns that hold them
| Field | What to enter, and the column or columns |
|---|---|
| RT-01 Request ID | R-year-nnn. Column: Request ID. |
| RT-02 Customer | The customer or prospect, by tracker reference. Column: Customer. |
| RT-03 Kind | One of: Questionnaire; Due diligence call; Audit request; Contract security schedule. Column: Kind. |
| RT-04 Received on | The day it reached anyone in the organisation. Column: Received on. |
| RT-05 Due on | The date agreed with the customer. Column: Due on. |
| RT-06 Response lead | A named person. Column: Response lead. |
| RT-07 Status | One of: Received; Triaged; Drafting; In approval; Submitted; Follow-up open; Closed; Declined. Column: Status. |
| RT-08 Questions | Total, current, stale and unmatched, as counts. Columns: Questions: total; current; stale; unmatched. |
| RT-09 Decision | One of: Answer in full; Point to a certificate or the overview; Decline. Column: Decision. |
| RT-10 Submitted on | The day the response left. Column: Submitted on. |
| RT-11 Commitments | The CM IDs logged for the request. Column: Commitments. |
| RT-12 Evidence sent | The EI IDs sent, with the day. Column: Evidence sent. |
| RT-13 Copy reference | Where the exact response as sent is kept. Column: Copy reference. |
The eight commitment fields and the columns that hold them
| Field | What to enter, and the column or columns |
|---|---|
| CF-01 Commitment ID | CM-nn. Column: Commitment ID. |
| CF-02 Request | The request or earlier form it was made in. Column: Request. |
| CF-03 Customer | By tracker reference. Column: Customer. |
| CF-04 Commitment | The words, as the customer received them. Column: Commitment. |
| CF-05 Made on | The day of the response. Column: Made on. |
| CF-06 Owner and due date | A named role and a date, or the word Continuing. Columns: Owner; Due on. |
| CF-07 Supported by | One of: Contract clause; Control in place; Approved plan; None, with the reference. Columns: Supported by; Support reference. |
| CF-08 Status | One of: Open; Done; Corrected. Column: Status. |
The working columns
| Column | What it is for |
|---|---|
| Note (Requests) | A line on why a request is where it is: a late response, a declined sender, the route to Legal. It is not a field of the pack. |
| Found on, Corrected on, Note (Commitments) | The dates a wrong commitment was found and corrected (QG-19), and a line about it. A commitment that is Corrected keeps its row. |
| Row in use, flags and lists (calc) | Columns the workbook calculates to run the checks and to count. Do not type or paste over them. |
Rules the tracker uses, by ID
| Rule | What it sets in this tracker |
|---|---|
| QG-03, IN-01 | Every request is logged the day it arrives, with one named response lead, a due date agreed with the customer and an entry here within the days the method sets. |
| QG-17 | Every commitment made in or around a response is logged with an owner, a due date and what supports it. The response lead reports the open ones, and those past their due date, every month. |
| QG-18 | A request that cannot be met by its due date is renegotiated with the customer before that date, with a reason and a new date. Change the due date and say why in the note. |
| QG-16 | An exact copy of every response as sent is kept. The copy reference says where. |
| QG-09 | A form creates no commitment. A promise found in an answer goes to Legal before the response goes out. A commitment with no support is not kept quietly. |
| QG-19 | A wrong answer is corrected and the customer is told. A commitment that turns out to be unsupported is marked Corrected here and keeps its row. |
| IN-02, IN-08 | Reuse is counted at triage as counts of questions: how many have a current library answer, how many a stale one and how many none. |
| QM-01, QM-02, QM-05 | The measures this workbook computes: responses sent by their due date, questions answered from current library answers, and commitments past their due date. QM-03 and QM-04 come from the library and the evidence index. |
| P09 IM-01 | The incident route. A request that turns out to report an incident is not tracked here: it goes to the incident route. |
The EXAMPLE customers
| Reference | Customer, sector and relationship |
|---|---|
| C-01 | Retail group, Food retail. Customer. |
| C-02 | Hospital group, Health. Customer. |
| C-03 | Regional public body, Public administration. Customer. |
| C-04 | Convenience-store chain, Food retail. Customer. |
| P-01 | Marketing platform vendor, Software. Other. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 4.2 — Understanding the needs and expectations of interested parties | Requests sheet: the needs and expectations of an interested party, here a customer, are received, logged and answered by a date |
| NIST CSF 2.0 | GV.OC-02 — “Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered” | Requests and Commitments sheets: what customers expect of the organisation's cybersecurity is understood and kept as a record |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(d) — “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” | Requests sheet: a customer that is an essential or important entity manages the security of its direct suppliers under Article 21(2)(d). A request is how that duty reaches you. The tracker shows who asked, what and when you answered. The Article binds the customer and gives it no right to an answer from you |
| GDPR — Regulation (EU) 2016/679 | Article 28(3)(h) — the processing contract stipulates that the processor “makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller”; the processor immediately informs the controller if, in its opinion, an instruction infringes data protection law | Requests sheet, Kind column: a processing contract asks the processor to make information available to the controller and to allow for audits. An audit request is logged as a kind of request, so that it is answered on time and the reply is on record |
| GDPR — Regulation (EU) 2016/679 | Article 5(2) — “The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).” | Requests and Commitments sheets: a controller must be able to show what it did. The dates, owners and copy references are a record of what you told each customer and when |
| ENISA, Procurement guidelines for the cybersecurity of hospitals and healthcare providers (July 2026) | Measure SOURCE-01 asks hospitals, when feasible, to prioritise suppliers “who demonstrate certified compliance with relevant security standards and regulations”; its checks include criteria that “prioritise suppliers with certified or independently assessed security postures” and an assessment of the supplier's incident response plans | Requests sheet, Evidence sent column: ENISA's measure for hospitals asks them to prefer suppliers that show certified or independently assessed security. A hospital group's request is one the tracker holds, with the evidence you sent |
| Shared Assessments, Standardized Information Gathering (SIG) | SIG Evolution (SIG EV) — “the web-based delivery of the Standardized Information Gathering (SIG) methodology”, which the FAQ says preserves the SIG's “content, structure, and methodology” and is not a replacement for a third-party risk management platform | Requests sheet, Kind column: a customer may send a standard form, such as the SIG, through a portal. It is logged like any other request. The tracker holds none of the form's questions |
Editions referenced: Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); CSA CCM, CAIQ and STAR, the Shared Assessments SIG, and SOC 2 (by name and title only), as their publishers state them; as published and read on 9 October 2026
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, DORA or the GDPR, or that your organisation holds a certificate.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.
Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 21(2)(d) and 21(3) ask a customer that is such an entity to manage the security of its direct suppliers and service providers, and to take into account the quality of their cybersecurity practices. They bind the customer. They do not give it a right to an answer from you. ENISA's guidance for hospitals says the Directive does not directly impose requirements on ICT suppliers and that its obligations take effect through national law. A questionnaire is the customer's way of meeting its own duty, and what you owe it comes from your contract. A supplier that is itself an essential or important entity has its own Article 21 duties, which this pack does not restate.
Regulation (EU) 2016/679 binds controllers and processors. Where you process personal data on a customer's behalf you act as its processor, and Article 28(3) sets what the contract holds, including information to show compliance and audits. Where you decide the purposes and means yourself, you are a controller of that data. The role depends on the facts for each processing, and counsel confirms it. Article 32 asks both roles for security that is appropriate to the risk.
ENISA's guidance and the NCSC's principles are guidance for buyers. They are not law, and they do not say what the contract between you and a customer must hold. ENISA says its publication does not endorse a regulatory obligation.
The CSA CAIQ, CCM and STAR, the Shared Assessments SIG and the certificates and reports a customer may ask for are industry practice and voluntary guidance. They are not law. No law named here requires you to complete a customer's form, and completing one, or holding a certificate or report, is not a statement that you comply with NIS2, DORA, the GDPR or any standard. This pack cites each as its publisher states it.