Response Quality & Over-Commitment Checklist

Checks answers for accuracy, consistency with prior answers and unsupported contractual promises.

Available soon

Format: Excel
Size: 136 KB
Length: 12 sheets
Version: 1.0
Updated: 9 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.09 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Use this workbook with the Questionnaire Response Governance Method and the Questionnaire Intake, Drafting & Approval Procedure. Complete one copy for every response before it goes out (QG-11). The questionnaire response lead completes it, and releases the response only when the open rows are cleared or a new date is agreed with the customer (QG-18).
2	On the Response Check sheet, enter the request ID, the customer, the kind of request, the response lead, the date of the check and the number of answers in the response. Take the request ID and customer from the Questionnaire Request Tracker.
3	On the Answer Check sheet, list every answer that is not a library answer used unchanged. Use one row for each. Say whether a library answer was used, the topic, the scope of claim and the evidence. A library answer used unchanged needs no row unless you want to record it.
4	Read each answer against the eight checks on the Checks and Approvals sheet. Choose Yes under a check when its words, or a close variant, appear in the answer. The sheet does not scan text. Leave a check blank when the answer is a library answer used unchanged and the library entry already shows that check cleared.
5	Read the Kind of answer and Approvers columns. A flag raises the kind of answer, and the highest kind wins. Nobody approves an answer they wrote, so say who wrote it and the next level steps in (QG-08). The questionnaire response lead releases every answer, and never approves one they wrote.
6	The approver named reads each flag and clears it in writing. Enter the approver's name and the date under Flags cleared and approved by. A promise, a date, a right of audit or access, or a liability goes to Legal (QG-09). It is not left in an answer.
7	Work down the Response Check sheet. For each item choose Met, Not met, Not checked or Not applicable. Met needs the place where the evidence is kept. Not applicable needs a reason in the note. Not met needs a note and a name.
8	If an answer is wrong after it has gone out, enter it on the Correction Log sheet. The sheet says whether the correction is material or minor, which steps apply, who approves it, and the date the customer must be told by.
9	Read the counts at the top of the Response Check sheet. They show items met, not met and not checked, area by area, and the answers still open. They never become a score or a share. Keep the completed workbook with the response (QG-16). To clear the EXAMPLE, delete the EXAMPLE sheet.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

QG-11: Run the response quality and over-commitment checklist (A06) on every response before it goes out. The approver that the kind of answer sets clears each flag, in writing.

P06 covers the questionnaires your organisation sends to its suppliers. This pack covers the ones it receives from its customers and answers as a supplier. P06's tiers, clause library and evidence checklist show what a customer that follows the same model will probably ask for. This pack does not change them.

Covering statement for the response (Legal confirms the wording): These responses describe [[organisation]] as at [[date of response]], for the scope each answer states. They are given in good faith to help [[customer]] assess its supplier. They do not change the agreement between us. A commitment is made only in the agreement or in a schedule that both parties have signed.

This document helps you answer security questionnaires from your customers. It is not legal advice, and an answer, a certificate or a schedule from this pack is not a statement that you comply with NIS2, DORA, the GDPR or any standard. A response is a statement your organisation is held to. Ask counsel to confirm any answer that a customer could treat as a promise or as a legal claim, and whether a customer is a financial entity or an essential or important entity.

EXAMPLE: the distributor, as at 30 Sep 2026, selling to business customers. The EXAMPLE sheet shows five flagged drafts, the library answers they were corrected to, and one correction.

Hidden columns on the Answer Check sheet hold the workings of the kind of answer and the approvers. Leave them as they are.

Adapting this template.

Small organisation: one person often holds the lead role and the topic owner role. The sheet then names the next level to approve, which is the Head of Information Security or an executive. Keep the Answer Check sheet to the answers that are not library answers used unchanged, so a long form does not mean a long sheet.

Regulated organisation: add columns to the right of the calculated ones for what your regulator or customer asks of your responses. Do not insert columns between the existing ones, because the formulas read them by position.

Service provider or outsourced IT: if a supplier writes or hosts part of your responses, you still complete this checklist under your own response lead. Ask the supplier for the evidence behind any answer it gave you, and record what it could not show as Not met.

Replace the [[placeholders]]. Delete the EXAMPLE sheet before use. Keep the formulas.

Fill one copy of the Response Check and Answer Check sheets for each response. To check a second response, save a copy of the workbook.

The Answer Check sheet has room for 120 answers, and the Correction Log for 20 corrections. To add rows, copy a whole blank row to the bottom of the table.

Response Check

Response check: [[request ID and customer]]

One copy of this workbook for each response. Yellow cells are yours. State now, the counts and the Check column calculate. Counts only, never a score.

The response

Request ID (tracker)			[[R-yyyy-nnn]]
Customer (tracker reference)			[[C-nn]]
Kind of request
Questionnaire response lead			[[Name]]
Date of this check			[[YYYY-MM-DD]]
Answers in the response (number)
Answers used unchanged from the library and not listed (calc)

Where the check stands

Items met, of those that apply			0 of 18 applicable items met; 0 not met, 18 not checked
Items not met			None
Items not checked			QC-01, QC-02, QC-03, QC-04, QC-05, QC-06, QC-07, QC-08, QC-09, QC-10, QC-11, QC-12, QC-13, QC-14, QC-15, QC-16, QC-17, QC-18
Answers			0 answers listed: 0 library answers, 0 adapted answers, 0 new answers, 0 contractual commitments, 0 legal or regulatory claims; 0 with a flag; 0 still open

By area

Area	Items	Apply	Not checked
Accuracy	4	4	4
Consistency	4	4	4
Claims	2	2	2
Promises	4	4	4
Handling	4	4	4
All items	18	18	18

Counts of items, never a share.

The items, QC-01 to QC-18

Item	Area	What to check	Requirement or rule	State now	Check
QC-01	Accuracy	Each answer is a library answer used unchanged, or was written or confirmed by the topic owner who runs the control it describes.	QG-04, QG-05	Not checked	Choose a state
QC-02	Accuracy	Each answer that states a control, a test or an assurance cites evidence from the index, or is marked Statement only.	QG-06	Not checked	Choose a state
QC-03	Accuracy	Each answer says what it covers, and none implies a wider scope than its evidence has.	QG-07	Not checked	Choose a state
QC-04	Accuracy	Each answer about AI was confirmed by the AI governance lead against the AI inventory, and states no risk category and no role under any law.	QG-20	Not checked	Choose a state
QC-05	Consistency	Each answer matches the library. Where it differs from an earlier response to this customer or on this form, the reason is written down.	QG-05, IN-02	Not checked	Choose a state
QC-06	Consistency	No library answer used is Stale or Withdrawn, unless its owner confirmed or changed it first.	QG-12, AL-09	Not checked	Choose a state
QC-07	Consistency	Every evidence item cited is in date today. An item that expires soon says so.	QG-13, EV-10	Not checked	Choose a state
QC-08	Consistency	Each answer on telling customers of an incident points to the incident notification procedure and the standard schedule, and states no period of its own.	QG-21	Not checked	Choose a state
QC-09	Claims	Each certificate is named by its exact title, scope, issuer and dates. A supplier's certificate is labelled as the supplier's.	QG-10, QG-14	Not checked	Choose a state
QC-10	Claims	No answer says the organisation is certified, compliant or aligned unless the evidence index holds a current document for that scope and Legal confirmed the wording.	QG-10	Not checked	Choose a state
QC-11	Promises	The eight checks were run on every answer that is not a library answer used unchanged. The approver the kind of answer sets cleared each flag in writing.	QG-11, AL-08	Not checked	Choose a state
QC-12	Promises	No answer holds a date, an action, an absolute word, a right of audit or access, or a liability. Any that was found went to Legal.	QG-09	Not checked	Choose a state
QC-13	Promises	Each request for an audit, a visit or access to systems went to Legal, and report-based assurance was offered.	IN-07	Not checked	Choose a state
QC-14	Promises	Each commitment made in or around the response is logged in the tracker with an owner, a due date and what supports it.	QG-17	Not checked	Choose a state
QC-15	Handling	Evidence went out by its sharing tier, released by the person the tier names. Where the tier needs a non-disclosure agreement, one covers the recipient.	QG-13, EV-12	Not checked	Choose a state
QC-16	Handling	The response carries no other customer's name, data or terms, and goes by the customer's channel or an encrypted route.	QG-15	Not checked	Choose a state
QC-17	Handling	Text that a drafting tool suggested came only from the library. The tool is approved for the data it saw, and the text took the approval of a new or adapted answer.	QG-22	Not checked	Choose a state
QC-18	Handling	The covering statement is on the response. An exact copy, with its approvals and the evidence versions it cited, is kept.	QG-16	Not checked	Choose a state

Sign-off

Role	Name	Date	Signature or reference
Checked (Questionnaire response lead)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Cleared where a commitment or a claim was found (Legal)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]
Cleared where a new answer was written (Head of Information Security)	[[Name]]	[[YYYY-MM-DD]]	[[Reference]]

Answer Check

Answers that need a check, and who must approve each

One row for each answer that is not a library answer used unchanged. Yellow cells are yours. The flags, the kind of answer, the approvers and the Check column calculate. The checks are on the Checks and Approvals sheet (QG-11).

Where the answers stand

Answers	0 answers listed: 0 library answers, 0 adapted answers, 0 new answers, 0 contractual commitments, 0 legal or regulatory claims; 0 with a flag; 0 still open

To fix

Open rows	0

The answers

Ref	Question	Answer as it will be sent	Library answer ID	Library answer used?	Library state	Topic	Scope of claim	Evidence (EI IDs or Statement only)	OC-01 Absolute words	OC-02 Time and frequency promises	OC-03 Claims about everything	OC-04 Certification and compliance claims	OC-05 Promise verbs	OC-06 Audit and access rights	OC-07 Liability, cost and remedy	OC-08 The future stated as the present	Flags raised	Kind of answer	Matches earlier answers?	Personal data in a commitment or claim?	Written by	Approvers	Flags cleared and approved by (name, date)	Note	Check

What to put in each column

Column		What to enter
Ref		The question's number in the customer's form.
Library answer ID		The SA ID of the library answer behind this answer. Leave it blank when there is none.
Library answer used?		Used unchanged: the words are exactly the library answer's. Wording changed: you altered them for this form. No library answer: nothing in the library covers the question.
Library state		The state the library shows today (Current, Review due, Evidence expiring, Stale, Evidence expired, Not approved, Withdrawn and the rest). Enter it when you use a library answer.
Scope of claim and Evidence		Pick the scope of claim. List the EI IDs of the evidence, or write Statement only.
OC-01 to OC-08		Choose Yes under a check when its words, or a close variant, appear in the answer. If the answer is a library answer used unchanged and the library entry already shows that check cleared, leave it blank (AL-08).
Matches earlier answers?		Compare with the library answer and with the last response to this customer or on this form (IN-02). Choose Differs when the words or the meaning changed, and say why in the note.
Personal data in a commitment or claim?		Yes if a commitment or claim in the answer concerns personal data. The Data Protection Officer then approves too.
Written by		The role of the person who wrote the answer. Nobody approves an answer they wrote, so the next level steps in.
Flags cleared and approved by		The name and date of the approver the sheet names. Enter it only when the approver has read the flags and cleared each one in writing.

Checks and Approvals

The eight checks, and who approves what

The checks, the kinds of answer, the roles and the topics that the Answer Check sheet reads. The words, the routes and the approvers are those of the method, so this sheet and the Answer Check sheet cannot differ.

The checks OC-01 to OC-08

ID	Check	Words that trigger it	Why it matters	What to do	Turns the answer into
OC-01	Absolute words	always; never; guarantee; 100%; zero; completely; fully; at any time; at all times; without exception; no exceptions; impossible; any and all	An absolute word is false the first time there is one exception.	Say what is true and how often, or for what.	Adapted answer
OC-02	Time and frequency promises	within N hours, days or months; every N months or years; at least once every; immediately; at once; same day; 24/7; real time; round the clock	A period or a frequency in a form reads as a promise the customer can hold you to.	Point to the period in the standard schedule, or to the procedure that sets it. Never state a new one.	Contractual commitment
OC-03	Claims about everything	all, every, any or each + systems, sites, suppliers, staff, customers, data or services; the entire; company-wide; across the organisation; everywhere	A claim about all systems, all sites or all staff covers more than the evidence does.	Name the service, site or system the answer covers, and give its scope of claim.	Adapted answer
OC-04	Certification and compliance claims	certified; certificate; certification; accredited; audited; attested; compliant; complies with; in compliance; meets the requirements; aligned with; conforms to	A statement that the organisation is certified, compliant or aligned is a legal claim about a scope.	Name the document, its scope, issuer and dates, and say whose it is. Legal confirms the wording.	Legal or regulatory claim
OC-05	Promise verbs	we will; we shall; we agree to; we commit to; we undertake to; we promise; we are committed to; will notify; shall provide	We will and we shall turn a description into a promise.	Describe what is done today, in the present tense, or point to the standard schedule.	Contractual commitment
OC-06	Audit and access rights	right to audit; audit rights; on-site; inspect; inspection; unrestricted access; access to our systems, premises or sites; you may audit	A right to audit, inspect or enter is a contract term with its own conditions.	Offer report-based assurance (SC-03) and send the request to Legal.	Contractual commitment
OC-07	Liability, cost and remedy	liable; liability; indemnify; compensate; at our cost; at no cost; service credit; penalty; damages; warranty	Liability, indemnity, free work and service credits are contract terms.	Remove the term and refer the question to Legal.	Contractual commitment
OC-08	The future stated as the present	planned; plan to; in the process of; currently implementing; roadmap; by the end of; next quarter; soon; shortly; under development	A plan, worded as if it were in place, is a false statement.	State what is in place today. Give a plan its own scope of claim (CS-7) and its date.	Adapted answer

The kinds of answer, lowest to highest, and who approves each in the standard case

Order	Kind of answer	Approvers (standard case)	Raised by	Also
1	Library answer	Questionnaire response lead	A library answer used unchanged, and in date	The Questionnaire response lead releases the answer and wrote none of it.
2	Adapted answer	Topic owner	OC-01, OC-03, OC-08; or a library answer with changed wording, or in a state that is not usable	A role that wrote the answer does not approve it: the next level steps in.
3	New answer	Topic owner, Head of Information Security	No library answer behind it	A role that wrote the answer does not approve it: the next level steps in.
4	Contractual commitment	Legal, Head of Information Security	OC-02, OC-05, OC-06, OC-07	The Data Protection Officer approves too when the commitment concerns personal data.
5	Legal or regulatory claim	Legal, Head of Information Security	OC-04	The Data Protection Officer approves too when the claim concerns personal data.

The roles, and who steps in when a role wrote the answer

No.	Role	Stands in when it wrote the answer
1	Questionnaire response lead	Head of Information Security
2	Topic owner	Head of Information Security
3	Account owner	None
4	Head of Information Security	Executive decision-maker
5	Legal	Executive decision-maker
6	Data Protection Officer	Legal
7	Head of IT	Head of Information Security
8	AI governance lead	Head of Information Security
9	Executive decision-maker	Executive decision-maker

The library topics, and the role that owns each

No.	Topic	Owner role	Review interval, months
1	Governance	Head of Information Security	12
2	Access	Head of IT	12
3	Data protection	Head of IT	12
4	Incident notice	Head of Information Security	6
5	Resilience	Head of IT	12
6	Development	Head of IT	12
7	Suppliers	Head of Information Security	12
8	AI	AI governance lead	6
9	Privacy	Data Protection Officer	12
10	Physical	Topic owner	12

The questionnaire response lead releases every answer and approves none they wrote. The account owner writes no security answer and sends only what the response lead has released.

Correction Log

A wrong answer, and the route to correct it

One row for each answer found wrong after it went out. Yellow cells are yours. The route is the method's (QG-19). An unsupported commitment or an overstated scope is always material. Any other error is material if the customer relied on it or it is written into the contract.

Settings and counts

Corrections			0 corrections logged: 0 material, 0 minor; 0 to the incident route; 0 still open
Working days to tell the customer of a material correction			5	A house default. Set your own (QG-19). Monday to Friday; add any public holidays by hand.

The corrections

Ref	What was wrong	Kind of error	Date found	Date confirmed (blank: same as found)	Customer relied on it?	Written into the contract?	Shows a control that does not work?	Exposes personal data?	Material or minor	Steps (CR)	Approvers	Tell the customer by	Incident route?	Corrected on	Check

The nine steps, CR-1 to CR-9

Step		What to do
CR-1		Withdraw the answer from the library at once and record the cause (AL-10).
CR-2		Search the tracker and the stored responses for every response that used the answer, and list the customers.
CR-3		The topic owner states the correct answer. The response lead drafts the correction from it.
CR-4		Rate the correction minor or material with the method's rule.
CR-5		Minor: correct it in the library, tell the account owner, and put the right answer in the next response. No notice is sent.
CR-6		Material: Legal and the Head of Information Security approve a written correction. The account owner sends it within the correction window of the error being confirmed.
CR-7		Where the answer was written into the contract, or the customer relied on it, Legal decides whether the contract is amended.
CR-8		Where the error shows a control that does not work, or exposes personal data, report it as an event through the incident route (P09 IM-01).
CR-9		Log the correction in the commitments log as Corrected, add it to the measures, and review why it happened.

A control that does not work, or personal data that is exposed, is an event. It goes through the incident route and is not handled only as a correction.

EXAMPLE

EXAMPLE: the distributor and five flagged drafts

The distributor, as at 30 Sep 2026, answering a hospital group's 300-question form. Every value is made up. Delete this sheet before use.

Five drafts, ticked against the eight checks

Ref	Question	Draft answer, from an earlier form	Library answer used?	Topic	OC-01 Absolute words	OC-02 Time and frequency promises	OC-03 Claims about everything	OC-04 Certification and compliance claims	OC-06 Audit and access rights	Personal data?	Written by	Flags raised	Kind of answer	Approvers	Corrected to
Q-087	Are you ISO 27001 certified?	Yes, we are ISO 27001 certified through our hosting provider.	No library answer	Governance				Yes		No	Questionnaire response lead	OC-04	Legal or regulatory claim	Legal, Head of Information Security	SA-005
Q-114	Do you assess all critical suppliers every year?	We assess all critical suppliers every year.	No library answer	Suppliers			Yes			No	Questionnaire response lead	OC-03	New answer	Head of Information Security	SA-031
Q-203	Do you notify customers of an incident within 12 hours?	We notify all affected customers within 12 hours of any incident.	No library answer	Incident notice		Yes	Yes			No	Questionnaire response lead	OC-02, OC-03	Contractual commitment	Legal, Head of Information Security	SA-018
Q-231	Do you test your systems every six months?	Penetration tests of all systems are carried out every six months.	No library answer	Development		Yes	Yes			No	Questionnaire response lead	OC-02, OC-03	Contractual commitment	Legal, Head of Information Security	SA-026
Q-266	Can we audit your premises and systems?	Yes, you may audit our premises and systems at any time.	No library answer	Governance	Yes				Yes	No	Questionnaire response lead	OC-01, OC-06	Contractual commitment	Legal, Head of Information Security	SC-03 of the standard schedule, through Legal

Each draft came from an earlier form, not from the library, so each starts as a new answer. A flag raises it to the check's route, and the highest kind wins. The questionnaire response lead wrote the drafts, so the response lead approves none of them. Q-266 has no library answer. The standard schedule has the answer, and the Head of Information Security owns it.

The same questions, answered from the library

Ref	Corrected to	Library answer	State on 30 Sep 2026	Kind when checked again	Flags already cleared in the library entry
Q-087	SA-005	No. We do not hold an ISO/IEC 27001 certificate for our own organisation. Our hosting provider holds one for its hosting service, and its certificate and scope statement are available. Our security programme runs under the policies described in this document.	Evidence expiring	Library answer	OC-04
Q-114	SA-031	Our third-party security policy places suppliers in tiers by how critical they are and sets a questionnaire and evidence for each tier. It requires critical suppliers to be reassessed at least every 12 months and when something material changes.	Review due	Library answer	OC-02
Q-203	SA-018	The period is set in the standard security commitments schedule and in your contract. It follows the rules in our incident notification procedure.	Current	Library answer	None
Q-231	SA-026	Yes. An independent party tests the online ordering service at least once a year. A summary of the March 2026 test is available under a non-disclosure agreement.	Current	Library answer	OC-02
Q-266	SC-03 of the standard schedule	Each year, on request, we give you our current independent assurance documents for the services we provide to you ([[list: certificates, test summaries, attestation letters]]) and we answer reasonable written questions about them. We do not give access to our systems, premises or the data of other customers. Where a law or a competent authority requires an audit of the services, we cooperate with it on terms we agree in advance.	Not in the library	Contractual commitment	Through Legal; report-based assurance is the default offer (IN-07)

A wrong answer, found and corrected: CM-01

Material or minor (calc)		Material
Ref		CM-01
What was wrong		We test all systems every six months. Made on 20 Nov 2025, in R-2025-061 (a form of November 2025).
Kind of error		Unsupported commitment
Date found		26 Aug 2026
Date confirmed		26 Aug 2026
Customer relied on it?		No
Written into the contract?		No
Shows a control that does not work?		No
Exposes personal data?		No
Corrected on		2 Sep 2026
Steps (calc)		CR-1, CR-2, CR-3, CR-4, CR-6, CR-9
Approvers (calc)		Legal, Head of Information Security
Tell the customer by (calc)		2 Sep 2026
Incident route? (calc)		No
Check (calc)		OK

The independent test is once a year and covers the online ordering service. A correction went to the customer, and SA-027 was withdrawn. The correction reached the customer on 2 Sep 2026, inside the window the steps set. The steps CR-1 to CR-9 are on the Correction Log sheet.

Lists

ItemState	YesNo	FlagYes	LibraryUse	LibraryState	TopicList	ScopeOfClaim	MatchesEarlier	AuthorRole	AnswerKind	RequestKind	ErrorKind
Met	Yes	Yes	Used unchanged	Withdrawn	Governance	CS-1 Whole company	Matches the library or an earlier answer	Questionnaire response lead	Library answer	Questionnaire	Factual error
Not met	No		Wording changed	Not approved	Access	CS-2 Named service	Differs, reason in the note	Topic owner	Adapted answer	Due diligence call	Overstated scope
Not checked			No library answer	No scope	Data protection	CS-3 Named site	No earlier answer	Account owner	New answer	Audit request	Unsupported commitment
Not applicable				No evidence reference	Incident notice	CS-4 Named system or tool list		Head of Information Security	Contractual commitment	Contract security schedule	Outdated answer
				Evidence expired	Resilience	CS-5 Supplier's service, not ours		Legal	Legal or regulatory claim		Wrong evidence
				Stale	Development	CS-6 Written policy only		Data Protection Officer
				Evidence expiring	Suppliers	CS-7 Plan with a date		Head of IT
				Review due	AI			AI governance lead
				Current	Privacy			Executive decision-maker

Physical

Definitions

Definitions

Term	Meaning in this workbook
Response	Everything the organisation sends back for one request: the answers, the evidence and any covering statement.
Answer	One reply to one question. An answer is a statement the organisation is held to.
Library answer	An approved answer held in the Security Answer Library, with its scope, evidence, owner and review date. Used unchanged, it needs no new approval.
Adapted answer	A library answer whose words are changed for one request. It is confirmed by the topic owner.
New answer	An answer with no library answer behind it. It is approved by the Head of Information Security and then added to the library.
Contractual commitment	A commitment that a customer could enforce. It belongs in the contract, through the standard schedule or the negotiation ladder, and never in a form.
Over-commitment	A statement that promises or claims more than the contract, the controls or the evidence support: an absolute word, a time promise, a claim about everything, a claim of certification or compliance, or a disguised promise.
Scope of claim	What an answer covers: the whole company, a named service, a named site, a named system or tool list, a supplier's service, a written policy only, or a plan with a date. An answer never implies a wider scope than its evidence has.
Stale	A library answer whose review date has passed. A stale answer is not sent until its owner has confirmed or changed it.
Evidence	A document that supports an answer: a certificate, an audit report, a penetration test summary, a policy extract, a diagram, an insurance certificate or an attestation letter.
Kind of answer	One of five, lowest to highest: library answer, adapted answer, new answer, contractual commitment, legal or regulatory claim. The kind decides who approves. A flag raises the kind, and the highest kind wins.
Flag	A check from OC-01 to OC-08 that you ticked Yes because its words are in the answer.
Cleared	The approver has read the flag and accepted the wording in writing. A library answer used unchanged keeps the flags that were cleared in its entry (AL-08).
Approvers	The roles that approve the answer. The role that wrote it does not approve it, and the next level steps in. The data protection officer joins for a commitment or claim about personal data.
Material correction	A correction that the customer must be told about. An unsupported commitment and an overstated scope are always material. Any other error is material if the customer relied on it or it is written into the contract.
Minor correction	A correction made in the library with no notice to the customer. The right answer goes into the next response.
Hidden columns	The workings behind the kind of answer and the approvers. They stay hidden. Do not overwrite them.
Met	You looked at the response and the evidence shows the item holds. Say where the evidence is.
Not met	The item does not hold. Say what is missing, and name who puts it right.
Not checked	Nobody has looked yet. The sheet counts it apart, and it is never counted as met.
Not applicable	The item cannot apply to this response. Say why in the note.
QC-nn, QG-nn	One of the items of this checklist, and the requirement of the Questionnaire Response Governance Method that the item checks.
OC-nn, CR-n	One of the eight over-commitment checks, and one of the nine correction steps.
EXAMPLE	An illustration: the distributor, as at 30 Sep 2026. Every name and value is made up.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 4.2 — Understanding the needs and expectations of interested parties	Response Check sheet: a customer is an interested party, and its security questions are answered through one controlled route
NIST CSF 2.0	GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed”	Answer Check and Correction Log sheets: a promise in an answer is a contractual matter, and it is found, routed to Legal and tracked
NIS2 — Directive (EU) 2022/2555	Article 21(3) — measures take into account each direct supplier's specific vulnerabilities and the overall quality of its products and cybersecurity practices, including secure development	Answer Check sheet: a customer takes the quality of its suppliers' cybersecurity practices into account, so an answer describes practice as it is and says what it covers
DORA — Regulation (EU) 2022/2554	Article 30(2) — minimum contract content: services, locations, data protection, data return, service levels, incident assistance, cooperation with authorities, termination rights, training	Checks and Approvals sheet, OC-02, OC-06 and OC-07: periods, audit rights and liability are terms of the kind a contract with a provider holds, so they go to Legal and stay out of answers
GDPR — Regulation (EU) 2016/679	Article 28(3) — a binding contract with the processor, covering documented instructions, confidentiality, security, sub-processors, assistance, return or deletion of data, and audits	Checks and Approvals sheet, OC-06 and the Approvers column: the terms of a processing contract, such as audits and information, are set in the contract and not in a form
GDPR — Regulation (EU) 2016/679	Article 33(2) — “The processor shall notify the controller without undue delay after becoming aware of a personal data breach.”	Response Check sheet, QC-08 and OC-02: an answer on telling customers of an incident points to the notification procedure and states no period of its own
ENISA, Procurement guidelines for the cybersecurity of hospitals and healthcare providers (July 2026)	Measure MANAGE-03, incident monitoring — “The supplier must notify the healthcare entity without undue delay of incidents that could impact the security of the entity’s network and information systems.” The hospital is told to set up a simple reporting mechanism and to treat a supplier-reported incident as seriously as an internal one	Response Check sheet, QC-08: customers expect a supplier to tell them of incidents without undue delay, and the answer points to where that duty is set
UK NCSC, Supply chain security guidance	Principle 5, “Set and communicate minimum security requirements for your suppliers” — “You should set minimum security requirements for suppliers which are justified, proportionate and achievable.” It asks the buyer to consider “different protection requirements for different types of contracts, based on the risk associated with them”, and to avoid forcing every supplier to meet the same set	Answer Check sheet, scope of claim: a buyer sets different requirements for different contracts, so each answer says which service, site or system it covers
UK NCSC, Supply chain security guidance	Principle 10, “Build assurance activities into your supply chain management” — “Build the 'right to audit' into all contracts and exercise this.” It adds that this “might not always be possible or desirable, particularly where this relates to a Cloud service”, and that, where justified, a buyer builds in assurance requirements such as penetration tests, external audit or formal security certifications	Response Check sheet, QC-13, and Checks and Approvals sheet, OC-06: a buyer may ask for a right to audit, and the default offer is report-based assurance through Legal

Editions referenced: Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); CSA CCM, CAIQ and STAR, the Shared Assessments SIG, and SOC 2 (by name and title only), as their publishers state them; as published and read on 9 October 2026

Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 21(2)(d) and 21(3) ask a customer that is such an entity to manage the security of its direct suppliers and service providers, and to take into account the quality of their cybersecurity practices. They bind the customer. They do not give it a right to an answer from you. ENISA's guidance for hospitals says the Directive does not directly impose requirements on ICT suppliers and that its obligations take effect through national law. A questionnaire is the customer's way of meeting its own duty, and what you owe it comes from your contract. A supplier that is itself an essential or important entity has its own Article 21 duties, which this pack does not restate.

Regulation (EU) 2022/2554 binds the financial entities of its Article 2. Articles 28 to 30 say what a financial entity does about ICT third-party risk and what its contract with an ICT third-party service provider holds. A provider is bound to them through that contract. Article 30(3) asks for more where the service supports a critical or important function of the financial entity. A customer that is not a financial entity cannot rely on Article 30 to ask the same of you. Counsel confirms whether a customer is a financial entity and whether a service supports a critical or important function of it.

Regulation (EU) 2016/679 binds controllers and processors. Where you process personal data on a customer's behalf you act as its processor, and Article 28(3) sets what the contract holds, including information to show compliance and audits. Where you decide the purposes and means yourself, you are a controller of that data. The role depends on the facts for each processing, and counsel confirms it. Article 32 asks both roles for security that is appropriate to the risk.

ENISA's guidance and the NCSC's principles are guidance for buyers. They are not law, and they do not say what the contract between you and a customer must hold. ENISA says its publication does not endorse a regulatory obligation.

This pack does not say which certificate, report or form meets a requirement of NIS2, DORA or the GDPR. Each reference says what its source asks of the customer or the provider and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, DORA or the GDPR, or that your organisation holds a certificate.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.