Questionnaire Response Governance Method

Purpose

A questionnaire answer is a statement the organisation is held to. A customer reads it as a description of what the organisation does, relies on it when it decides to buy, and may point to it later if something goes wrong. So the organisation answers once, from an approved source, with evidence behind it, and says what the answer covers. A form is not the place to agree a new commitment. Promises are made in the contract, through a standard schedule and a short ladder of approvals, and an answer never promises what the contract or the controls do not support. The result is counts of requests answered on time, answers reused, evidence in date and commitments kept. It is never one score.

This method commits [[Organisation Name]] to the same approach. It sets 23 requirements, QG-01 to QG-23, for every security questionnaire, due diligence request, audit request and contract security schedule that a customer or prospect sends. Each requirement names the risks it answers (RK-01 to RK-12) and the evidence a reviewer looks at. Every other document in the Security Questionnaire & Due Diligence Response pack cites the requirements by number.

The other documents in the pack put the method into practice. The Questionnaire Intake, Drafting & Approval Procedure takes a request from receipt to submission. The Security Answer Library, Evidence & Attestation Library Index, Response Quality & Over-Commitment Checklist and Questionnaire Request Tracker hold the answers, the evidence, the checks and the record. The Customer-Facing Security Overview Document and the Standard Security Commitments Schedule are what you hand to customers.

What this method leaves to P06. P06 covers the questionnaires your organisation sends to its suppliers. This pack covers the ones it receives from its customers and answers as a supplier. P06's tiers, clause library and evidence checklist show what a customer that follows the same model will probably ask for. This pack does not change them.

Legal note. This document helps you answer security questionnaires from your customers. It is not legal advice, and an answer, a certificate or a schedule from this pack is not a statement that you comply with NIS2, DORA, the GDPR or any standard. A response is a statement your organisation is held to. Ask counsel to confirm any answer that a customer could treat as a promise or as a legal claim, and whether a customer is a financial entity or an essential or important entity.

Scope

This method applies to:

• Requests: every questionnaire, due diligence call, audit request and contract security schedule from a customer or a prospect in a live sales opportunity. That includes the customer's own form, a standard form such as the CSA CAIQ or the Shared Assessments SIG, and a short question by email or on a call (QG-01).
• People: everyone who receives, triages, drafts, confirms, approves, releases or sends a response, in sales, security, IT, legal, privacy and operations (QG-02).
• Answers and evidence: the library of approved answers, the index of evidence and attestations, the commitments log and the copies of what was sent.

Out of scope: the questionnaires the organisation sends to its own suppliers, which the Third-Party Security Risk Management pack covers, and the reports it must make to authorities, which the Regulatory Incident Notification & Reporting pack covers.

Excluded: [[anything deliberately left out, and where it is covered instead, e.g. requests for a regulated product, handled by a separate quality process; or "None"]].

Everything the organisation already does for incidents, records, classification and supplier assurance still applies and is not repeated here: incidents under the Security Incident Management pack, reporting under the Regulatory Incident Notification & Reporting pack, records under the Cyber Resilience & Recovery pack and the three data levels under the Information Classification & Handling pack.

How this method works

Every request answers five questions: who may answer; what may an answer say; who approves it; what may leave the building; what happens after it is sent. The requirements are the detail.

Five kinds of answer

The kind of an answer decides who approves it (QG-08). A library answer is the lightest. A promise or a claim of certification is the heaviest. The over-commitment checks below raise the kind of an answer when its words need it, so a short, harmless-looking sentence can still reach Legal.

Nobody approves an answer they wrote. The next level takes their place (QG-08). For example, if the Head of Information Security writes a new answer, the executive decision-maker approves it. The questionnaire response lead releases a library answer and approves nothing they drafted themselves.

What an answer covers

Every answer carries one scope of claim (QG-07). The scope stops a true answer for one service from being read as a true answer for the company.

The state of a library answer

The library works out a state for each answer from its dates and its evidence (QG-12). An answer in one of the first six states below is not sent as it stands. The warning window is 60 days for evidence and a shorter window for review dates.

What customers ask

A customer that follows the model of the Third-Party Security Risk Management pack asks for more as it rates you higher. The table is read from that pack's tiers, unchanged. It shows what to expect, and the method treats every tier the same way.

Where the questions come from

NIS2. Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 21(2)(d) and 21(3) ask a customer that is such an entity to manage the security of its direct suppliers and service providers, and to take into account the quality of their cybersecurity practices. They bind the customer. They do not give it a right to an answer from you. ENISA's guidance for hospitals says the Directive does not directly impose requirements on ICT suppliers and that its obligations take effect through national law. A questionnaire is the customer's way of meeting its own duty, and what you owe it comes from your contract. A supplier that is itself an essential or important entity has its own Article 21 duties, which this pack does not restate.

DORA. Regulation (EU) 2022/2554 binds the financial entities of its Article 2. Articles 28 to 30 say what a financial entity does about ICT third-party risk and what its contract with an ICT third-party service provider holds. A provider is bound to them through that contract. Article 30(3) asks for more where the service supports a critical or important function of the financial entity. A customer that is not a financial entity cannot rely on Article 30 to ask the same of you. Counsel confirms whether a customer is a financial entity and whether a service supports a critical or important function of it.

GDPR. Regulation (EU) 2016/679 binds controllers and processors. Where you process personal data on a customer's behalf you act as its processor, and Article 28(3) sets what the contract holds, including information to show compliance and audits. Where you decide the purposes and means yourself, you are a controller of that data. The role depends on the facts for each processing, and counsel confirms it. Article 32 asks both roles for security that is appropriate to the risk.

Industry forms and certificates. The CSA CAIQ, CCM and STAR, the Shared Assessments SIG and the certificates and reports a customer may ask for are industry practice and voluntary guidance. They are not law. No law named here requires you to complete a customer's form, and completing one, or holding a certificate or report, is not a statement that you comply with NIS2, DORA, the GDPR or any standard. This pack cites each as its publisher states it.

Guidance for buyers. ENISA's guidance and the NCSC's principles are guidance for buyers. They are not law, and they do not say what the contract between you and a customer must hold. ENISA says its publication does not endorse a regulatory obligation.

Risks this method answers

The method answers twelve named risks. Each requirement answers at least one, and each risk is answered by at least two requirements. If you adopt fewer requirements, check that each risk still has two.

Requirements

The requirements keep the IDs QG-01 to QG-23 that every document in the Security Questionnaire & Due Diligence Response pack cites. Values in [[brackets]] are the pack's defaults. Set your own before approval. Under each requirement, the risks it answers and the evidence a reviewer looks at.

Receiving and owning a request

Every request has one owner, and only people who know the control write about it.

QG-01 Every security questionnaire, due diligence request, audit request and contract security schedule from a customer or prospect goes through this method. Nobody answers a customer's security question outside it, and that includes a short reply by email or on a call.

Answers: RK-01, RK-10. Evidence: the tracker (A07) showing every request, including those that arrived by email or on a call; no response in a customer's channel that the tracker does not hold.

QG-02 Only the questionnaire response lead and the topic owners the library names enter an answer. The account owner manages the relationship and sends only what the response lead has released. Nobody in sales writes a security answer.

Answers: RK-10, RK-02. Evidence: the list of people who enter answers (the response lead and the topic owners the library names); the sent items of the account owners for the period.

QG-03 Each request has one named response lead from receipt to close, a due date agreed with the customer, and an entry in the tracker (A07) within [[2]] working days of receipt.

Answers: RK-09, RK-10. Evidence: the tracker entry: one named response lead, the received date, the agreed due date, and the date the request was logged and triaged.

QG-04 A topic owner, the person who runs the control, writes or confirms every answer that is not already in the library. Nobody confirms an answer about a control they do not run.

Answers: RK-02, RK-10. Evidence: the library entry or the new-answer record naming the topic owner, who runs the control the answer describes.

What an answer says and what stands behind it

Answer from the library, back each claim with evidence, and say what it covers.

QG-05 Use the library answer unchanged when its state lets it go out as it stands (Current, Review due or Evidence expiring). Change an answer in the library first, with its owner's approval, and then use it. Do not edit an answer inside a customer's form.

Answers: RK-01, RK-05, RK-12. Evidence: the response compared with the library: each answer is the library's words, or an adapted answer with its confirmation; the library changed before the form did.

QG-06 An answer that states a control, a test or an assurance cites evidence from the index (A05) or says that it is a statement only. A claim with neither is not sent.

Answers: RK-02, RK-03. Evidence: the evidence reference in each library entry (EI IDs from the index, or the words Statement only).

QG-07 Every answer says what it covers: the whole company, a named service, a named site, a named system or tool list, a supplier's service, a written policy only, or a plan with a date. An answer never implies a wider scope than its evidence has.

Answers: RK-03, RK-02. Evidence: the scope of claim in each library entry, and the evidence item's own scope beside it.

Approval, promises and claims

The kind of answer sets the approver. A form never makes a promise.

QG-08 The approver follows the kind of answer. The response lead releases a library answer. The topic owner confirms an adapted answer. The Head of Information Security approves a new answer. Legal and the Head of Information Security approve a contractual commitment and a legal or regulatory claim. Nobody approves an answer they wrote: the next level takes their place.

Answers: RK-10, RK-04, RK-02. Evidence: the approval record for each answer that is not a library answer, with the kind of answer and the approver's role; no approver who wrote the answer.

QG-09 A form is not a contract. An answer creates no commitment. A commitment is made only through the standard schedule (A09) and its ladder. A promise found in an answer, such as a date, an action, an absolute word, a right of audit or access, or a liability, goes to Legal before the response is sent.

Answers: RK-04. Evidence: the commitments log (A07); the list of promises found in the response and the Legal decision on each; the standard schedule (A09) offered where a customer asked for terms.

QG-10 Name a certificate by its exact title, scope, issuer and dates, and say whose it is. Say that the organisation is certified, compliant or aligned only when the evidence index holds a current document that says it for the scope stated and Legal has confirmed the wording. A supplier's certificate is never presented as the organisation's own.

Answers: RK-03, RK-04. Evidence: the evidence item's title, scope, issuer and dates beside the answer; for a claim of certification or compliance, Legal's written confirmation.

QG-11 Run the response quality and over-commitment checklist (A06) on every response before it goes out. The approver that the kind of answer sets clears each flag, in writing.

Answers: RK-04, RK-02, RK-01, RK-12. Evidence: the completed checklist (A06) for the response, with every flag cleared in writing by the approver the kind of answer sets.

The library and the evidence

Keep answers in date, and send evidence only to those who may have it.

QG-12 Every topic and every library answer has a named owner. An answer is reviewed by its review date: [[12]] months after its last review, and [[6]] months for incident notice and AI. A stale answer is not sent until its owner has confirmed or changed it.

Answers: RK-05, RK-01. Evidence: the library's owner and review date for each answer; the count of answers past their review date; no stale answer in a sent response.

QG-13 Release evidence by its sharing tier. The response lead releases Public items. The Head of Information Security releases Under NDA items once a non-disclosure agreement covers the recipient, and releases a Summary only item as its approved summary and nothing more. A Never shared item is not released. Evidence past its expiry is not sent.

Answers: RK-06, RK-05. Evidence: the evidence index (A05) with the sharing tier of each item; the release record in the tracker; the non-disclosure agreement in force on the day, where a tier asks for one.

QG-14 A document that belongs to a supplier, such as a certificate or a report, is shared only as that supplier's terms allow, and is described as the supplier's.

Answers: RK-06, RK-03. Evidence: the supplier's terms in the index entry; the label that names the supplier on what was sent.

QG-15 A customer's questionnaire and the reply are Confidential. They are kept in the tracker's store and sent only through the customer's channel or an encrypted route. An answer to one customer carries no other customer's name, data or terms.

Answers: RK-11. Evidence: where the questionnaire and the reply are stored; the route used to send them; a check that no response names another customer.

Records, commitments, deadlines and correction

A response is a record. What it promises is tracked, and a wrong answer is put right.

QG-16 Keep an exact copy of every response as sent, its approvals, the evidence versions it cited and its covering statement, for [[3]] years after the relationship ends, or longer where a contract or a law asks (P22).

Answers: RK-08, RK-07. Evidence: the stored copy of each response as sent, with its approvals, the evidence versions it cited and its covering statement, and the retention period set.

QG-17 Log every commitment made in or around a response, with an owner, a due date and what supports it. The response lead reports open commitments and those past their due date every month.

Answers: RK-07. Evidence: the commitments log: each commitment with its owner, due date and support; the monthly report of open and overdue commitments.

QG-18 A request that cannot be met by its due date is renegotiated with the customer before that date, with a reason and a new date, and the change is recorded. A request is never left to lapse.

Answers: RK-09. Evidence: the tracker's due dates and any renegotiated date with its reason; no request left past its date without a record.

QG-19 A wrong answer is withdrawn from the library at once, every response that used it is found, and the customer is told by the correction route in this method. A material correction reaches the customer within [[5]] working days of the error being confirmed.

Answers: RK-08, RK-01. Evidence: the correction record: the withdrawn answer, the list of responses that used it, the rating, the approvals, and the date the customer was told.

Answers that need extra care

AI, incident notice and drafting tools each have a source of truth outside the form.

QG-20 An answer about the organisation's use of AI comes from the AI inventory and the reviews behind it (P24, P25) and is confirmed by the AI governance lead. It states no risk category and no role under any law.

Answers: RK-02, RK-03. Evidence: the AI inventory (P24) and the reviews behind it (P25), and the AI governance lead's confirmation of each AI answer.

QG-21 An answer about telling customers of an incident points to the organisation's incident notification rules (P09, P18) and to the period in the standard schedule. It states no period of its own and promises no notice that those rules do not provide.

Answers: RK-04, RK-02. Evidence: the incident notice answers, each pointing to the incident notification rules and the schedule's notice field, with no period of its own.

QG-22 A tool, including an AI assistant, may suggest a draft only from the library and only if it is on the approved list for the data it sees (P24). A drafted answer is a new or adapted answer and takes its approval. A customer's questionnaire is not put into a tool that is not approved for Confidential data.

Answers: RK-12, RK-11. Evidence: the approved tools list (P24) for the data the drafting tool sees; the record that a drafted answer took its approval; a check that no questionnaire was put into a tool not approved for Confidential data.

Reviewing the method

The method is reviewed on a fixed cycle and after the events that matter.

QG-23 This method is reviewed at least every [[12]] months (P04 Standard tier), and after a wrong answer is found, a new certificate or report is issued, a major system changes or the law changes. The response lead reports counts of requests, answers reused, answers past review, evidence nearing expiry and commitments open.

Answers: RK-05, RK-08. Evidence: the document control table; the record of the last review and the triggers considered; the counts reported to the leadership team.

The over-commitment checks

QG-11 asks you to check every response before it goes out. The Response Quality & Over-Commitment Checklist runs eight checks on the words of each answer. A check that fires is a flag. The flag does not mean the answer is wrong. It means a person with the right authority must read it, and clear it in writing, before it is sent. A library answer whose flag was cleared at approval keeps the flag cleared while its words stay unchanged. Change one word and it is checked again.

The schedule is the place for promises. The Standard Security Commitments Schedule holds the commitments the organisation is willing to make, with fallback wording. A form points to it. It does not repeat it with new words.

Departures from the standard schedule

The ladder has three steps: the standard wording, the fallback wording, and an exception. The account owner offers the first two. An exception is a departure from the standard. It is rated on the bands of the Information Security Risk Management pack and approved as an exception under the Security Exception & Waiver Standard (P02-A02, Security Exception, Waiver & Segregation of Duties pack), with Legal added. The owner of the risk is never among the approvers. The approvers by band are below.

Sharing evidence

Evidence supports an answer, and some of it must not leave the organisation. Every item in the Evidence & Attestation Library Index carries one sharing tier (QG-13). The tier decides who releases it and whether it may be sent at all.

An item past its expiry date is not sent. An item that expires within 60 days carries a warning, and you say so when you send it. A supplier's certificate or report is shared only as the supplier's terms allow, labelled as the supplier's, with its scope (QG-14). It is never presented as the organisation's own. Where a recipient has no non-disclosure agreement in force, offer the Public items, and a summary only where the summary's own sharing tier is Public (EV-13), and send the request for an agreement to Legal.

Correcting a wrong answer

A wrong answer is found sooner or later: by the owner at a review, by a customer, or by someone comparing two responses. QG-19 sets the route. The steps are the same every time, and the rating decides how far they go.

CR-1 Withdraw the answer from the library at once and record the cause (AL-10).

CR-2 Search the tracker and the stored responses for every response that used the answer, and list the customers.

CR-3 The topic owner states the correct answer. The response lead drafts the correction from it.

CR-4 Rate the correction minor or material with the method's rule.

CR-5 Minor: correct it in the library, tell the account owner, and put the right answer in the next response. No notice is sent.

CR-6 Material: Legal and the Head of Information Security approve a written correction. The account owner sends it within the correction window of the error being confirmed.

CR-7 Where the answer was written into the contract, or the customer relied on it, Legal decides whether the contract is amended.

CR-8 Where the error shows a control that does not work, or exposes personal data, report it as an event through the incident route (P09 IM-01).

CR-9 Log the correction in the commitments log as Corrected, add it to the measures, and review why it happened.

Rating. A correction is material when the wrong answer was an unsupported commitment or an overstated scope, when the customer relied on it, or when it is in the contract. Any other error is minor. A material correction is approved by Legal and the Head of Information Security, and the account owner sends it within [[5]] working days of the error being confirmed. A minor correction needs no notice. Where the error shows a control that does not work, or exposes personal data, it also goes to the incident route (CR-8).

Roles and responsibilities

Every request has one questionnaire response lead, named in the tracker. The response lead owns the request, keeps the library, the evidence index and the tracker, and reports the measures. One person may hold several roles in a small organisation, with two limits: nobody approves an answer they wrote, and nobody in sales writes a security answer (QG-02). The rules of the Information Security Risk Management pack and the Security Exception, Waiver & Segregation of Duties pack on approving exceptions stay as those packs set them.

The matrix sets out who is responsible (R), accountable (A), consulted (C) and informed (I) for each of 15 activities. Columns, in order: Lead for questionnaire response lead; Topic for topic owner; Acct for account owner; Sec for Head of Information Security; Legal for Legal; DPO for Data Protection Officer; IT for Head of IT; AI for AI governance lead; Exec for executive decision-maker.

Review and change

Measures

The questionnaire response lead reports five measures each period (QG-23). Each is a count with the gaps named. None is combined into a score or a share.

Reviewing the method

This method is reviewed at least every [[12]] months (Security Policy Management pack, Standard tier), and after a wrong answer is found, a new certificate or report is issued, a major system changes or the law changes (QG-23). The Security Policy Management pack also names these triggers: a major incident, or an incident the document should have prevented; a material change to the organisation's activities, systems or suppliers; a change in law, regulation or a contract the document supports; an audit or assessment finding against the document; a significant change in the threats the document addresses. The review is recorded in the document control table.

Changing the method. The questionnaire response lead proposes a change and consults the topic owners and Legal. The approver of the Standard tier approves it. A change that tightens a requirement says by when responses already in progress must meet it.

Related documents

Definitions

Document control

Approval record

Review. See Review and change. This method is reviewed at least every 12 months (QG-23).

Worked example: the hospital group's questionnaire

EXAMPLE, not part of the method. The organisation is the one used throughout the packs, now as a seller: a wholesale distributor of food and catering supplies with about 900 staff, an important entity under NIS2 in its Member State. It sells to business customers: retailers, a hospital group and a regional public body. Replace it with your own, or delete this section before approval.

The method was approved on 25 Aug 2026 by the Head of Information Security. The Questionnaire response lead owns the method, and nobody approves a document they own (P04 PF-03), so the Head of Information Security approves it at P04's Standard tier. The answers came from earlier forms and spreadsheets. Each keeps the date its owner last confirmed it, so some are past their review dates. The distributor holds no ISO/IEC 27001 certificate of its own. Its hosting provider holds one for the hosting service. P08's example is a different company, a software firm working towards its first certificate.

Triage. A hospital group sent a 300-question form on its own portal. At triage, 198 of 300 questions can be answered from current library answers. The decision was "answer in full". The form is above the largest standard set, so the response lead offered the overview and the evidence first (IN-06), and the customer still wanted its own form answered. The plan, by kind of answer: 198 library answers, 42 adapted answers and 60 new answers. For an access answer, for instance, the Head of IT confirms an adapted answer and the Head of Information Security approves a new one.

The checks at work. Five drafts for the form were written quickly, as drafts tend to be. The checklist flagged each one. The table shows the flags, the kind each draft became, who approved the corrected answer and what was sent instead.

The position for the leadership team: 3 of 4 responses went out by their due date; 422 of 576 questions had a current library answer; 6 library answers are past their review date; 1 evidence item expires within 60 days; 0 commitments are past their due date.

The library: 50 answers: 28 Current, 3 Review due, 3 Evidence expiring, 6 Stale, 9 Draft, 1 Withdrawn; 34 can be sent as they stand. The tracker: 3 of 4 answered requests went out by their due date; 0 open requests overdue; 4 commitments open, 0 past their due date.

Adapting this template

Small organisation

Regulated entity (NIS2, DORA, GDPR)

IT and services run by suppliers

Framework references

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); CSA CCM, CAIQ and STAR, the Shared Assessments SIG, and SOC 2 (by name and title only), as their publishers state them; as published and read on 9 October 2026.

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, DORA or the GDPR, or that your organisation holds a certificate.

A reference says what its source asks of the customer or the provider, and which CISO Times document helps with that work. It does not say that an answer, a certificate or a schedule from this pack meets a requirement of NIS2, DORA or the GDPR.

This pack does not say which certificate, report or form meets a requirement of NIS2, DORA or the GDPR. Each reference says what its source asks of the customer or the provider and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.