Security Answer Library

Approved standard answers by topic with evidence references, review date and approved scope of claim.

Available soon

Format: Excel
Size: 87 KB
Length: 11 sheets
Version: 1.0
Updated: 9 Oct 2026

Follow this documentFree account. We can email you when it changes.

What's inside

Instructions
Library
Summary
Structure
Evidence
Lists
Definitions
Framework References

What changed

1.09 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Read the Structure sheet: the ten topics, the seven scopes of claim and the structure rules AL-01 to AL-10. Set each topic's review interval. The defaults are 12 months, and 6 months for incident notice and AI.
2	On the Evidence sheet, copy the items of your evidence index (Evidence & Attestation Library Index) that answers cite: ID, title, sharing tier, expiry date and status. The index is the master. Write None for an item that does not expire.
3	On the Library sheet, add one row for each standard question. Write the answer in customer-ready words, in the first person plural, with no internal ID in it (AL-02). Choose the topic and one scope of claim (AL-03). Name the evidence by its ID, or write Statement only (AL-04). Name the owner (AL-05).
4	Set the status. A new answer is a Draft. The approver for its kind of answer approves it, and you then set it to Approved and enter the day the owner last reviewed it (QG-08, Questionnaire Response Governance Method). The review date and the state follow from the dates (AL-06, AL-07).
5	If an answer passes the over-commitment checks with a flag, write the check IDs in the cleared-checks column, so that the next person does not raise it again. Change the words and the checks run again (AL-08). The checks are in the Response Quality & Over-Commitment Checklist.
6	On the Summary sheet, enter the day the states are worked out for. Read the counts by state and by topic. Send an answer only when the Can be sent column says Yes (QG-05).
7	Clear every row in the Check column. A row with a check to clear has a fault the state cannot show, such as evidence that is not on the Evidence sheet.
8	When an answer is wrong, set it to Withdrawn and write why in the withdrawn-because column. Do not delete it: the responses that used it can then be found (AL-10, QG-19).
9	Review every answer by its review date. The owner confirms it, with a new last-reviewed date, or changes it. A confirmation changes the date and nothing else (AL-09).

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Limitations: This document helps you answer security questionnaires from your customers. It is not legal advice, and an answer, a certificate or a schedule from this pack is not a statement that you comply with NIS2, DORA, the GDPR or any standard. A response is a statement your organisation is held to. Ask counsel to confirm any answer that a customer could treat as a promise or as a legal claim, and whether a customer is a financial entity or an essential or important entity.

The idea behind it. A questionnaire answer is a statement the organisation is held to. A customer reads it as a description of what the organisation does, relies on it when it decides to buy, and may point to it later if something goes wrong. So the organisation answers once, from an approved source, with evidence behind it, and says what the answer covers. A form is not the place to agree a new commitment. Promises are made in the contract, through a standard schedule and a short ladder of approvals, and an answer never promises what the contract or the controls do not support. The result is counts of requests answered on time, answers reused, evidence in date and commitments kept. It is never one score.

Counts, not a score. The result is the number of answers in each state and of evidence items near expiry. The workbook never adds them into a score.

How the answers are used. Copy an approved answer out of this workbook into the customer's form. Do not edit it inside the form, and do not send this workbook: the basis column is internal (QG-05, AL-02). P06 covers the questionnaires your organisation sends to its suppliers. This pack covers the ones it receives from its customers and answers as a supplier. P06's tiers, clause library and evidence checklist show what a customer that follows the same model will probably ask for. This pack does not change them.

EXAMPLE: the distributor, which sells to business customers: retailers, a hospital group and a regional public body, as at 30 Sep 2026. Its library holds 50 answers. 50 answers: 28 Current, 3 Review due, 3 Evidence expiring, 6 Stale, 9 Draft, 1 Withdrawn; 34 can be sent as they stand. It holds no ISO/IEC 27001 certificate of its own, and the library says so (SA-005).

Adapting this template

Small organisation: start with the topics your customers ask about most. Fifteen well-kept answers beat fifty stale ones. Keep the other topics on the sheet with no rows, and add them when a customer asks.

Regulated organisation: if a sector regulator or a customer contract asks for answers in a fixed form, keep the form's own wording in the question column and your approved answer beside it, and have Legal confirm any answer that a regulator could read as a statement of compliance.

Service provider or outsourced IT: if an outsourced IT provider runs a control, the answer is about the provider's service, not yours. Choose the scope of claim for a supplier's service (CS-5) and cite the provider's evidence as the provider's.

This workbook is your own record. Keep it with the evidence it rests on.

Library

One row for each approved answer. Yellow columns are yours; the others are worked out. Send the answer column to a customer, never this workbook. EXAMPLE: the distributor's library as at 30 Sep 2026.

Example	Answer ID	Topic	Question	Answer	Scope of claim	Evidence reference	Owner	Status	Last reviewed	Review date	Cleared checks	Basis (internal)	Withdrawn because	State on the day	Can be sent	Check	Expiry 1 (working)	Past review so far (working)
EXAMPLE	SA-001	Governance	Is there an information security policy approved by management?	Yes. Our information security policy is approved by our Executive Committee and reviewed every year. A signed-off summary is available.	CS-1	EI-04	Head of Information Security	Approved	15 Apr 2026	15 Apr 2027		P04 PF-03, P04 PF-06		Current	Yes	OK	15 Jan 2027
EXAMPLE	SA-002	Governance	Who is responsible for information security?	The Head of Information Security is responsible for the security programme. Executive management oversees it and receives a report on it every quarter.	CS-1	Statement only	Head of Information Security	Approved	15 Sep 2025	15 Sep 2026		P04 PF-12		Stale	No	OK		SA-002
EXAMPLE	SA-003	Governance	Do you assess information security risks?	Yes. Risks are written as scenarios, rated for impact and likelihood on a four-point scale, held in a risk register and reviewed by their owners every quarter. The whole register is reassessed every year.	CS-1	Statement only	Head of Information Security	Approved	20 May 2026	20 May 2027		P05 RM-01, P05 RM-09		Current	Yes	OK		SA-002
EXAMPLE	SA-004	Governance	Do staff receive security awareness training?	Yes. Everyone with an account completes a baseline security course at least once every 12 months.	CS-1	Statement only	Head of Information Security	Approved	10 Mar 2026	10 Mar 2027	OC-02	P16 AW-04		Current	Yes	OK		SA-002
EXAMPLE	SA-005	Governance	Do you hold an ISO/IEC 27001 certificate?	No. We do not hold an ISO/IEC 27001 certificate for our own organisation. Our hosting provider holds one for its hosting service, and its certificate and scope statement are available. Our security programme runs under the policies described in this document.	CS-1	EI-01	Head of Information Security	Approved	4 May 2026	4 May 2027	OC-04	P08-A06		Evidence expiring	Yes	OK	14 Nov 2026	SA-002
EXAMPLE	SA-006	Access	How do staff sign in to business systems?	Staff sign in with a personal work account through single sign-on. Systems that hold accounts are kept in an inventory with an owner, and a system found outside single sign-on is connected to it.	CS-1	Statement only	Head of IT	Approved	9 Jun 2026	9 Jun 2027		P13 JML-12		Current	Yes	OK		SA-002
EXAMPLE	SA-007	Access	How is access given, changed and removed?	Accounts are created, changed, suspended and removed from events in the HR record, or from a sponsor register for people who are not employees. Access outside a person's standard profile needs a business reason, the approval of the line manager and the system owner, and an expiry date.	CS-1	Statement only	Head of IT	Approved	9 Jun 2026	9 Jun 2027		P13 JML-01, P13 JML-04		Current	Yes	OK		SA-002
EXAMPLE	SA-008	Access	How is administrator access controlled?	Privileged accounts are held in an inventory with a named owner. Daily accounts hold no administrator rights. Privileged sign-in uses a phishing-resistant method, or the strongest method a system offers, and privileged access is reviewed every quarter.	CS-1	Statement only	Head of IT	Approved	20 Aug 2025	20 Aug 2026		P14 PA-01, P14 PA-03, P14 PA-05, P14 PA-16		Stale	No	OK		SA-002, SA-008
EXAMPLE	SA-009	Access	How do your customers' users sign in to the online ordering service?	Placeholder answer: the owner completes it before approval. [[Describe the sign-in for customer users, and whether multi-factor authentication is offered.]]	CS-2	Statement only	Head of IT	Draft				P13-A02		Not approved	No	OK		SA-002, SA-008
EXAMPLE	SA-010	Access	How are leavers handled?	A leaver's access is removed through the same HR event that ends their employment, and removal is checked in a regular report on leaver timeliness and orphaned accounts.	CS-1	Statement only	Head of IT	Approved	9 Jun 2026	9 Jun 2027		P13-A09, P13 JML-01		Current	Yes	OK		SA-002, SA-008
EXAMPLE	SA-011	Data protection	How do you classify information?	Information is classified at three levels: Public, Internal and Confidential. A system takes the highest level of the information it holds. Customer contracts and price lists are Confidential.	CS-1	Statement only	Head of IT	Approved	14 Jul 2026	14 Jul 2027		P15 CL-01, P24 T-01		Current	Yes	OK		SA-002, SA-008
EXAMPLE	SA-012	Data protection	Is customer data encrypted?	Placeholder answer: the owner completes it before approval. [[State how customer data is encrypted in transit and at rest on the online ordering service.]]	CS-2	Statement only	Head of IT	Draft				P15 CL-01		Not approved	No	OK		SA-002, SA-008
EXAMPLE	SA-013	Data protection	Where is customer data stored?	Placeholder answer: the owner completes it before approval. [[Name the region and the hosting provider's location terms.]]	CS-2	Statement only	Head of IT	Draft				P06 CL-05		Not approved	No	OK		SA-002, SA-008
EXAMPLE	SA-014	Data protection	Are backups taken and tested?	Data sets that our critical services need are listed in a backup coverage matrix with their owner, location and retention. We test the recovery of our critical services at least every 12 months.	CS-1	Statement only	Head of IT	Approved	14 Jul 2026	14 Jul 2027	OC-02	P23 BR-01, P22 RR-14		Current	Yes	OK		SA-002, SA-008
EXAMPLE	SA-015	Data protection	How is customer data returned or deleted at the end of the contract?	Our standard security commitments schedule sets how and when your data is returned or deleted at the end of the services.	CS-1	Statement only	Head of IT	Approved	14 Jul 2026	14 Jul 2027		P06 EXIT_TIMING, P06 CL-13		Current	Yes	OK		SA-002, SA-008
EXAMPLE	SA-016	Incident notice	Do you have an incident response plan?	Yes. We have an incident response plan with a reporting route that staff can use, defined severity levels and named roles. We exercise it at least once a year. A summary of the latest exercise is available under a non-disclosure agreement.	CS-1	EI-08	Head of Information Security	Approved	2 Apr 2026	2 Oct 2026	OC-02	P09 IM-01, P09 IM-03, P09 IM-12		Review due	Yes	OK	18 Mar 2027	SA-002, SA-008
EXAMPLE	SA-017	Incident notice	How will you tell us about a security incident that affects us?	Customers affected by a security incident are told through our communications lead, using approved templates. The period for telling you is set in your contract and in our standard security commitments schedule.	CS-1	Statement only	Head of Information Security	Approved	5 May 2026	5 Nov 2026		P09 IM-09, P18 RN-14, P18 RN-15		Current	Yes	OK		SA-002, SA-008
EXAMPLE	SA-018	Incident notice	How quickly will you notify us of an incident?	The period is set in the standard security commitments schedule and in your contract. It follows the rules in our incident notification procedure.	CS-1	Statement only	Head of Information Security	Approved	5 May 2026	5 Nov 2026		P09 RD-05, P09 RD-09, P18 RN-15		Current	Yes	OK		SA-002, SA-008
EXAMPLE	SA-019	Incident notice	Do you report incidents to the authorities?	We screen every declared incident against our reporting duties and make any report that the law requires, through the channel the authority sets.	CS-1	Statement only	Head of Information Security	Approved	10 Mar 2026	10 Sep 2026		P09 IM-06, P18 RN-02		Stale	No	OK		SA-002, SA-008, SA-019
EXAMPLE	SA-020	Incident notice	Have you had a security incident in the last 12 months that affected customers?	This is answered for each request by the Head of Information Security with Legal, from the incident log, as at the date of the response.	CS-1	Statement only	Head of Information Security	Approved	20 Apr 2026	20 Oct 2026		P09-A09		Review due	Yes	OK		SA-002, SA-008, SA-019
EXAMPLE	SA-021	Resilience	Do you have business continuity and disaster recovery plans?	Yes. Our critical services have recovery objectives and a recovery plan, and recovery is tested at least every 12 months. A statement of the latest test result is available under a non-disclosure agreement.	CS-1	EI-07	Head of IT	Approved	30 Jun 2026	30 Jun 2027	OC-02	P22 RR-04, P22 RR-14		Current	Yes	OK	29 Jun 2027	SA-002, SA-008, SA-019
EXAMPLE	SA-022	Resilience	What are the recovery objectives for the online ordering service?	Placeholder answer: the owner completes it before approval. [[State the objectives from the recovery objectives matrix as design objectives, not as a promise.]]	CS-2	Statement only	Head of IT	Draft				P22-A04		Not approved	No	OK		SA-002, SA-008, SA-019
EXAMPLE	SA-023	Resilience	How is a recovery decided in a crisis?	Recovery follows an order set in advance: foundations first, then critical services by recovery time, unless the crisis lead records another order and the reason.	CS-1	Statement only	Head of IT	Approved	30 Jun 2026	30 Jun 2027		P22 RR-08		Current	Yes	OK		SA-002, SA-008, SA-019
EXAMPLE	SA-024	Resilience	Do your plans take account of the loss of a key supplier?	Critical suppliers are listed with the services that depend on them, and the recovery plans take account of those dependencies.	CS-1	Statement only	Head of IT	Approved	30 Jun 2026	30 Jun 2027		P22-A07		Current	Yes	OK		SA-002, SA-008, SA-019
EXAMPLE	SA-025	Resilience	When did you last test recovery?	The latest recovery test of the online ordering service is recorded in a letter signed by the Head of IT and dated 30 June 2026. The letter is available under a non-disclosure agreement.	CS-2	EI-07	Head of IT	Approved	1 Jul 2026	1 Jul 2027		P23-A08		Current	Yes	OK	29 Jun 2027	SA-002, SA-008, SA-019
EXAMPLE	SA-026	Development	Is the online ordering service tested for vulnerabilities?	Yes. An independent party tests the online ordering service at least once a year. A summary of the March 2026 test is available under a non-disclosure agreement.	CS-2	EI-03	Head of IT	Approved	6 Apr 2026	6 Apr 2027	OC-02	P20 CA-01		Current	Yes	OK	26 Mar 2027	SA-002, SA-008, SA-019
EXAMPLE	SA-027	Development	How often do you test your systems?	Penetration tests of all systems are carried out every six months.	CS-1	Statement only	Head of IT	Withdrawn	20 Nov 2025	20 Nov 2026	OC-02, OC-03	P20 CA-01	The independent test is once a year and covers the online ordering service. A correction went to the customer, and SA-027 was withdrawn.	Withdrawn	No	OK		SA-002, SA-008, SA-019
EXAMPLE	SA-028	Development	How do you manage vulnerabilities and patches?	Systems are in an asset inventory with a patch owner and a maintenance window. Vulnerabilities are rated for urgency, and fixes follow the monthly cycle, an expedited route or an emergency route.	CS-1	Statement only	Head of IT	Approved	26 May 2026	26 May 2027		P17 PM-01, P17 PM-03		Current	Yes	OK		SA-002, SA-008, SA-019
EXAMPLE	SA-029	Development	Do you follow a secure development process?	Placeholder answer: the owner completes it before approval. [[Describe how the online ordering service is built and by whom.]]	CS-2	Statement only	Head of IT	Draft				P17-A02		Not approved	No	OK		SA-002, SA-008, SA-019
EXAMPLE	SA-030	Development	Will you share the results of your vulnerability scans or tests?	Raw scan results and full test reports are not shared. A summary of the independent penetration test is available under a non-disclosure agreement.	CS-2	EI-03	Head of IT	Approved	6 Apr 2026	6 Apr 2027		P20 CA-01		Current	Yes	OK	26 Mar 2027	SA-002, SA-008, SA-019
EXAMPLE	SA-031	Suppliers	Do you assess your suppliers' security?	Our third-party security policy places suppliers in tiers by how critical they are and sets a questionnaire and evidence for each tier. It requires critical suppliers to be reassessed at least every 12 months and when something material changes.	CS-6	Statement only	Head of Information Security	Approved	14 Oct 2025	14 Oct 2026	OC-02	P06 TP-02, P06 TP-03, P06 TP-09		Review due	Yes	OK		SA-002, SA-008, SA-019
EXAMPLE	SA-032	Suppliers	How many of your critical suppliers have been assessed?	This is answered for each request from the supplier register, as at the date of the response.	CS-1	Statement only	Head of Information Security	Approved	21 Jul 2026	21 Jul 2027		P06-A08		Current	Yes	OK		SA-002, SA-008, SA-019
EXAMPLE	SA-033	Suppliers	Do you keep a list of the suppliers that handle our data?	We keep a register of our suppliers, with the services each supports and the data it handles, and tell customers who ask which suppliers handle their information.	CS-1	Statement only	Head of Information Security	Approved	21 Jul 2026	21 Jul 2027		P06-A08		Current	Yes	OK		SA-002, SA-008, SA-019
EXAMPLE	SA-034	Suppliers	Do supplier contracts carry security requirements?	Security clauses are chosen by the supplier's tier and the type of data it handles, and are in the contract before it is signed.	CS-6	Statement only	Head of Information Security	Approved	21 Jul 2026	21 Jul 2027		P06 TP-07		Current	Yes	OK		SA-002, SA-008, SA-019
EXAMPLE	SA-035	Suppliers	Do you hold the certificates of your key suppliers?	We collect certificates and independent reports from critical suppliers as part of their assessment, and we check their scope and dates. Our hosting provider's ISO/IEC 27001 certificate is available and is that provider's own.	CS-5	EI-01	Head of Information Security	Approved	4 May 2026	4 May 2027	OC-04	P06 TP-04		Evidence expiring	Yes	OK	14 Nov 2026	SA-002, SA-008, SA-019
EXAMPLE	SA-036	AI	Do you have an AI policy?	Yes. Our AI acceptable use and security policy was approved by our Executive Committee on 11 Aug 2026. AI may be used for work only if it is on an approved list, and only with data that the list allows.	CS-1	Statement only	Head of Risk	Approved	20 Aug 2026	20 Feb 2027		P24 AG-02, P24 AG-03		Current	Yes	OK		SA-002, SA-008, SA-019
EXAMPLE	SA-037	AI	Is customer data put into generative AI tools?	Information we classify as Confidential, and personal data, is not entered into the generative AI tools that our staff use. A supplier's security monitoring service uses machine learning on log data to detect unusual activity.	CS-4	Statement only	Head of Risk	Approved	2 Mar 2026	2 Sep 2026		P24 T-01, P24 T-03, P24 AG-03		Stale	No	OK		SA-002, SA-008, SA-019, SA-037
EXAMPLE	SA-038	AI	Is customer information used to train AI models?	We do not train AI models on customer information. A bar on a supplier training on our data is a condition of approving a supplier's AI feature, and is checked before the feature is used.	CS-6	Statement only	Head of Risk	Approved	2 Mar 2026	2 Sep 2026		P24 AG-11		Stale	No	OK		SA-002, SA-008, SA-019, SA-037, SA-038
EXAMPLE	SA-039	AI	Does AI make decisions about people?	No AI output decides, alone, a matter that affects a person's job, pay, discipline, credit or access to a service. A named person decides.	CS-6	Statement only	Head of Risk	Approved	20 Aug 2026	20 Feb 2027		P24 AG-06		Current	Yes	OK		SA-002, SA-008, SA-019, SA-037, SA-038
EXAMPLE	SA-040	AI	Do you have a customer-facing AI chatbot?	No. A chatbot proposed for customer service is on hold and is not in use.	CS-1	Statement only	Head of Risk	Approved	25 Sep 2026	25 Mar 2027		P24-A05		Current	Yes	OK		SA-002, SA-008, SA-019, SA-037, SA-038
EXAMPLE	SA-041	Privacy	Do you have a Data Protection Officer?	Placeholder answer: the owner completes it before approval. [[Confirm whether one is appointed, and give the contact.]]	CS-1	Statement only	Data Protection Officer	Draft				P24-A04		Not approved	No	OK		SA-002, SA-008, SA-019, SA-037, SA-038
EXAMPLE	SA-042	Privacy	Are you a controller or a processor of our personal data?	This depends on the processing involved. We answer for the customer concerned, with Legal, from the contract and the processing.	CS-1	Statement only	Data Protection Officer	Approved	21 Jul 2026	21 Jul 2027		P06 CL-06		Current	Yes	OK		SA-002, SA-008, SA-019, SA-037, SA-038
EXAMPLE	SA-043	Privacy	Do you have processor terms for personal data?	Where we process personal data on a customer's behalf, our standard security commitments schedule carries the terms that Article 28(3) of the GDPR asks of a processing contract.	CS-1	Statement only	Data Protection Officer	Approved	21 Jul 2026	21 Jul 2027		P06 CL-06		Current	Yes	OK		SA-002, SA-008, SA-019, SA-037, SA-038
EXAMPLE	SA-044	Privacy	How do you handle requests from the people whose data you hold?	Placeholder answer: the owner completes it before approval. [[Describe the route for such requests.]]	CS-1	Statement only	Data Protection Officer	Draft				P09-A08		Not approved	No	OK		SA-002, SA-008, SA-019, SA-037, SA-038
EXAMPLE	SA-045	Privacy	Do suppliers process personal data for you?	This is answered for the customer concerned from the supplier register, as at the date of the response.	CS-1	Statement only	Data Protection Officer	Approved	21 Jul 2026	21 Jul 2027		P06-A08		Current	Yes	OK		SA-002, SA-008, SA-019, SA-037, SA-038
EXAMPLE	SA-046	Physical	Where are your sites?	We operate three warehouses. The online ordering service is hosted by our cloud hosting provider and is not run from the warehouses.	CS-3	Statement only	Head of Logistics	Approved	1 Sep 2025	1 Sep 2026		P06-A08		Stale	No	OK		SA-002, SA-008, SA-019, SA-037, SA-038, SA-046
EXAMPLE	SA-047	Physical	How is entry to your sites controlled?	Placeholder answer: the owner completes it before approval. [[Describe entry control, visitors and monitoring at each warehouse.]]	CS-3	Statement only	Head of Logistics	Draft				P15-A07		Not approved	No	OK		SA-002, SA-008, SA-019, SA-037, SA-038, SA-046
EXAMPLE	SA-048	Physical	How is the data centre that holds our data protected?	Customer data for the online ordering service is held in our hosting provider's data centres. Their physical security is covered by the provider's certification, and we rely on its certificate and scope statement.	CS-5	EI-01	Head of Logistics	Approved	4 May 2026	4 May 2027	OC-04	P06 TP-04		Evidence expiring	Yes	OK	14 Nov 2026	SA-002, SA-008, SA-019, SA-037, SA-038, SA-046
EXAMPLE	SA-049	Physical	How do you dispose of media and records?	Information is disposed of according to its classification. Confidential items are collected and destroyed by a provider that gives a certificate for each collection, and the certificate is kept.	CS-1	Statement only	Head of Logistics	Approved	23 Jun 2026	23 Jun 2027	OC-04	P15-A07, P20-A07		Current	Yes	OK		SA-002, SA-008, SA-019, SA-037, SA-038, SA-046
EXAMPLE	SA-050	Physical	Are your warehouses monitored?	Placeholder answer: the owner completes it before approval. [[Describe monitoring and alarms at each warehouse.]]	CS-3	Statement only	Head of Logistics	Draft				P15-A07		Not approved	No	OK		SA-002, SA-008, SA-019, SA-037, SA-038, SA-046

Add no rows below the table or outside it: the Summary sheet counts these rows only. A blank row is ignored. An approved answer with no last review date counts as Stale.

Summary

Summary

Counts of answers by state and by topic, and of evidence items near expiry, worked out for the day below from the Library and Evidence sheets. Every figure is a count. There is no score.

EXAMPLE: the distributor's library as at 30 Sep 2026. Clear the EXAMPLE column and the yellow cells to use your own.

Settings

Work out the states for	30 Sep 2026	The day the states are worked out for. Enter =TODAY() to use today's date. The EXAMPLE date is the last day of the worked example.
Review window (days)	30	An answer is Review due when its review date falls within this many days of the day above. The facts' default is shown.
Evidence window (days)	60	Evidence is expiring when its expiry date falls within this many days of the day above. The facts' default is shown.

Answers by state

State	Answers	Can be sent	What it means	What to do
Current	28	Yes	Approved, in date, with evidence in date.	Send it as it stands.
Review due	3	Yes	Its review date falls within the warning window. Send it, and review it.	Send it as it stands. Its owner reviews it before the review date.
Evidence expiring	3	Yes	A document it cites expires within the warning window. Send it, and renew the evidence.	Send it as it stands and say when the evidence expires. Ask the owner to renew the evidence (EV-09).
Stale	6	No	Its review date has passed. The owner confirms or changes it first (QG-12).	Do not send it. The owner confirms it with a new review date, or changes it (AL-09).
Evidence expired	0	No	A document it cites is past its expiry. Renew the evidence or change the answer.	Do not send it. Renew the evidence, or change the answer (EV-10).
No evidence reference	0	No	It cites no evidence and is not marked as a statement only (QG-06).	Do not send it. Name the evidence, or mark the answer Statement only (QG-06).
No scope	0	No	It names no claim scope, or one that is not in the vocabulary. Fix the entry.	Do not send it. Choose the scope of claim that its evidence supports (AL-03).
Not approved	9	No	A draft. Not sent until the approver has approved it.	Do not send it. The approver for its kind of answer approves it first (QG-08).
Withdrawn	1	No	Retired. Never sent.	Never send it. Keep it, with its reason, so that the responses that used it can be found (AL-10).
Answers in the library	50

The library in numbers

In one line	50 answers: 28 Current, 3 Review due, 3 Evidence expiring, 6 Stale, 9 Draft, 1 Withdrawn; 34 can be sent as they stand
Answers that can be sent as they stand	34	Current, Review due and Evidence expiring.
Answers with a fault to fix	0	Evidence expired, No evidence reference and No scope. A stale or draft answer is not a fault.
Library answers past their review date	6	Approved answers whose review date has passed on the day above (QM-03).
Which are past their review date	SA-002, SA-008, SA-019, SA-037, SA-038, SA-046
Evidence items expired or expiring	1	Items not withdrawn whose expiry date falls on or before the end of the evidence window (QM-04).
Which are expired or expiring	EI-01
Rows with a check to clear	0	See the Check column on the Library sheet.

By topic

Topic	Answers	Can be sent	Cannot be sent	Past review date
Governance	5	4	1	1
Access	5	3	2	1
Data protection	5	3	2	0
Incident notice	5	4	1	1
Resilience	5	4	1	0
Development	5	3	2	0
Suppliers	5	5	0	0
AI	5	3	2	2
Privacy	5	3	2	0
Physical	5	2	3	1

Limitations

A state says whether an answer may be sent as it stands. It does not say that the answer is right. The topic owner confirms that at each review.

The workbook knows the dates, the status, the scope and the evidence you enter. It does not read the words of an answer. Run the response quality and over-commitment checklist before a response goes out (QG-11).

The counts are counts of answers and of evidence items. Never turn them into a percentage, a score or a traffic-light total.

Evidence is read from the Evidence sheet. If that copy is out of date, the states are too. Refresh it from the evidence index before you rely on the counts.

An approved answer with no last review date counts as Stale until its owner enters one.

Structure

How the library is built

The structure rules, the ten topics with their review intervals, and the seven scopes of claim. The rules come from the Questionnaire Response Governance Method and this workbook applies them. Change a review interval only if your method says so.

Structure rules

Rule	What it says
AL-01	The library holds one answer per standard question, grouped under the ten topics: Governance, Access, Data protection, Incident notice, Resilience, Development, Suppliers, AI, Privacy and Physical.
AL-02	Field: answer. Customer-ready words, in the first person plural, with no internal document or rule IDs.
AL-03	Field: scope of claim. One of CS-1 to CS-7. An answer with none, or with a scope its evidence does not support, is not used.
AL-04	Field: evidence reference. The EI IDs of the index (A05) that support the answer, or the words Statement only.
AL-05	Field: owner. The topic owner, by title. The owner confirms the answer at each review.
AL-06	Field: review date. The last review plus the topic's interval: 12 months, and 6 months for incident notice and AI.
AL-07	Field: status. Draft, Approved or Withdrawn. The library adds the states Current, Review due, Evidence expiring, Stale and Evidence expired from the dates.
AL-08	An answer that passes the over-commitment checks with a flag keeps the flag cleared in its entry, with the check IDs. A changed answer is checked again.
AL-09	A stale answer is not sent. Its owner confirms it, with a new review date, or changes it. A confirmation changes the review date and nothing else.
AL-10	A withdrawn answer stays in the library with the reason, so that the responses that used it can be found (QG-19).

Topics

Topic	Owner (EXAMPLE)	Review interval (months)
Governance	Head of Information Security	12
Access	Head of IT	12
Data protection	Head of IT	12
Incident notice	Head of Information Security	6
Resilience	Head of IT	12
Development	Head of IT	12
Suppliers	Head of Information Security	12
AI	Head of Risk	6
Privacy	Data Protection Officer	12
Physical	Head of Logistics	12

Scopes of claim

Scope	Name	What it means
CS-1	Whole company	True of the whole organisation, as the answer says.
CS-2	Named service	True of one named service, such as the online ordering service, and no other.
CS-3	Named site	True of named sites, such as the three warehouses, and no other.
CS-4	Named system or tool list	True of the systems or tools named, or on the list as at the date shown.
CS-5	Supplier's service, not ours	True of a supplier's service. The supplier, not the organisation, holds the control and the attestation.
CS-6	Written policy only	What the organisation's written policy requires. The answer does not say that every case meets it.
CS-7	Plan with a date	A plan that is not yet in place, stated with its date. It is never worded as present.

An answer carries exactly one scope. It never implies a wider scope than its evidence has (Questionnaire Response Governance Method, QG-07).

Evidence

This is a short copy of the evidence index (A05), so that the library can see each item's expiry date. The index is the master. Copy the ID, the title, the sharing tier, the expiry date and the status from it, and write None for an item that does not expire.

Example	Evidence ID	Title	Sharing tier	Expires	Status	Expiry	Expired or expiring so far (working)
EXAMPLE	EI-01	Hosting provider's ISO/IEC 27001 certificate and scope statement	Public	14 Nov 2026	Current	Expiring	EI-01
EXAMPLE	EI-02	Penetration test report, online ordering service, March 2026	Summary only	26 Mar 2027	Current	In date	EI-01
EXAMPLE	EI-03	Penetration test summary, online ordering service, March 2026	Under NDA	26 Mar 2027	Current	In date	EI-01
EXAMPLE	EI-04	Information security policy, signed-off summary	Public	15 Jan 2027	Current	In date	EI-01
EXAMPLE	EI-05	Data-flow diagram, online ordering service (high level)	Under NDA	11 May 2027	Current	In date	EI-01
EXAMPLE	EI-06	Cyber insurance certificate	Under NDA	31 Mar 2027	Current	In date	EI-01
EXAMPLE	EI-07	Recovery test attestation, online ordering service, June 2026	Under NDA	29 Jun 2027	Current	In date	EI-01
EXAMPLE	EI-08	Incident response exercise summary, March 2026	Under NDA	18 Mar 2027	Current	In date	EI-01
EXAMPLE	EI-09	Internal control test results	Never shared	14 Sep 2027	Current	In date	EI-01

The sharing tier is shown for information. The evidence index sets who may receive an item and releases it (QG-13). This workbook does not decide that.

Lists

StatusList	EvStatusList	TierList
Draft	Current	Public
Approved	Withdrawn	Under NDA
Withdrawn		Summary only

Never shared

Definitions

Definitions

Term	Meaning in this workbook
Answer	One reply to one question. An answer is a statement the organisation is held to.
Library answer	An approved answer held in the Security Answer Library, with its scope, evidence, owner and review date. Used unchanged, it needs no new approval.
Adapted answer	A library answer whose words are changed for one request. It is confirmed by the topic owner.
New answer	An answer with no library answer behind it. It is approved by the Head of Information Security and then added to the library.
Scope of claim	What an answer covers: the whole company, a named service, a named site, a named system or tool list, a supplier's service, a written policy only, or a plan with a date. An answer never implies a wider scope than its evidence has.
Evidence	A document that supports an answer: a certificate, an audit report, a penetration test summary, a policy extract, a diagram, an insurance certificate or an attestation letter.
Statement only	The word written in the evidence column when an answer describes what the organisation does and no document supports it. It is a choice, and the approver sees it (QG-06).
Stale	A library answer whose review date has passed. A stale answer is not sent until its owner has confirmed or changed it.
State on the day	Where an answer stands on the day set on the Summary sheet: Current, Review due, Evidence expiring, Stale, Evidence expired, No evidence reference, No scope, Not approved, Withdrawn. The first rule that applies decides. The Summary sheet says what each means and what to do.
Can be sent	Yes for Current, Review due and Evidence expiring. No for every other state.
Review date	The last day the answer may be sent without a review: the last-reviewed date plus the topic's interval (AL-06).
Topic owner	The manager who runs the control an answer describes, and who writes or confirms answers on that topic.
Response lead	The person who owns a request from receipt to close, keeps the library, the evidence index and the tracker, and releases responses.
SA-nnn	An answer in the library. The example holds 50, five for each topic.
EI-nn	An item in the evidence index (Evidence & Attestation Library Index).
CS-1 to CS-7	The scopes of claim, listed on the Structure sheet.
AL-01 to AL-10	The structure rules of the library, listed on the Structure sheet.
QG-nn, EV-nn, OC-nn	Requirements of the Questionnaire Response Governance Method, rules of the Evidence & Attestation Library Index and checks of the Response Quality & Over-Commitment Checklist.
EXAMPLE	A worked example: the distributor, as at 30 Sep 2026. Clear the EXAMPLE values and the yellow cells before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 4.2 — Understanding the needs and expectations of interested parties	The workbook as a whole: customers are interested parties, and the library records what the organisation tells them
NIST CSF 2.0	GV.OC-04 — “Critical objectives, capabilities, and services that external stakeholders depend on or expect from the organization are understood and communicated”	Library sheet: the services that customers expect from the organisation are understood, and what is said about them is held in one approved place
NIS2 — Directive (EU) 2022/2555	Article 21(3) — measures take into account each direct supplier's specific vulnerabilities and the overall quality of its products and cybersecurity practices, including secure development	The workbook as a whole: a customer that falls under Article 21 weighs the cybersecurity practices of its suppliers, and sends questions for that reason. The Article binds the customer
GDPR — Regulation (EU) 2016/679	Article 32(1) — appropriate technical and organisational measures to ensure a level of security appropriate to the risk, taking into account the likelihood and severity of risk to people's rights and freedoms	Access, Data protection and Resilience answers: the security measures an answer describes are the ones Article 32 asks controllers and processors to have, appropriate to the risk
GDPR — Regulation (EU) 2016/679	Article 32(2) — in assessing the appropriate level of security, account is taken of the risks presented by processing	Data protection answers: the risks of processing are the ones an answer about security has to take into account
GDPR — Regulation (EU) 2016/679	Article 32(1)(d) — the security measures include, as appropriate, “a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing”	Resilience and Development answers: an answer about testing says what is tested, when and by whom, with the evidence named
ENISA, Procurement guidelines for the cybersecurity of hospitals and healthcare providers (July 2026)	Section 2.2.1 — where AI is involved, procurement documentation should require suppliers to disclose “the intended purpose and scope of the AI functionality, the AI provider and deployment model, relevant data processing arrangements, categories of data processed, storage and retention arrangements, subprocessors, human oversight measures, logging capabilities”, and procedures for notifying the healthcare entity of material changes. Sensitive information should not go to external AI services unless expressly authorised after the assessments the section lists	AI answers: what a hospital customer is told to ask of a supplier that uses AI, such as the purpose, the data processed and the human oversight
Cloud Security Alliance (CSA)	CSA Cloud Controls Matrix (CCM): “composed of 197 control objectives that are structured in 17 domains”. CSA's page says version 4.1 of the CCM and the Consensus Assessments Initiative Questionnaire (CAIQ) are combined, and that the CAIQ, built into the CCM, offers a set of yes-or-no questions for assessing cloud providers. A CCM licence is needed to customise it or use it commercially, and not for internal use	The topics of the library: a customer may send a standard form such as the CAIQ, and the library answers its questions once, from one source
Shared Assessments, Standardized Information Gathering (SIG)	Shared Assessments' SIG: the page describes it as a third-party risk management questionnaire standard that measures security risk across 21 risk domains, one of which is Artificial Intelligence (AI). The FAQ says the level to choose “is based on the depth and breadth of due diligence you need based on the third-party risk rating and vendor classification”: “The SIG Lite provides a foundation of low-risk level questions for third parties, while the SIG Core provides a comprehensive set of questions for third-party service providers that pose a higher risk.” It is a licensed product, and a buyer can mix scope levels by domain	The topics of the library: a customer may send a standard form such as the SIG, and the same answers serve it

Editions referenced: Directive (EU) 2022/2555 (NIS2); Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); CSA CCM, CAIQ and STAR, the Shared Assessments SIG, and SOC 2 (by name and title only), as their publishers state them; as published and read on 9 October 2026

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, DORA or the GDPR, or that your organisation holds a certificate.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.

Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 21(2)(d) and 21(3) ask a customer that is such an entity to manage the security of its direct suppliers and service providers, and to take into account the quality of their cybersecurity practices. They bind the customer. They do not give it a right to an answer from you. ENISA's guidance for hospitals says the Directive does not directly impose requirements on ICT suppliers and that its obligations take effect through national law. A questionnaire is the customer's way of meeting its own duty, and what you owe it comes from your contract. A supplier that is itself an essential or important entity has its own Article 21 duties, which this pack does not restate.

Regulation (EU) 2016/679 binds controllers and processors. Where you process personal data on a customer's behalf you act as its processor, and Article 28(3) sets what the contract holds, including information to show compliance and audits. Where you decide the purposes and means yourself, you are a controller of that data. The role depends on the facts for each processing, and counsel confirms it. Article 32 asks both roles for security that is appropriate to the risk.

The CSA CAIQ, CCM and STAR, the Shared Assessments SIG and the certificates and reports a customer may ask for are industry practice and voluntary guidance. They are not law. No law named here requires you to complete a customer's form, and completing one, or holding a certificate or report, is not a statement that you comply with NIS2, DORA, the GDPR or any standard. This pack cites each as its publisher states it.

ENISA's guidance and the NCSC's principles are guidance for buyers. They are not law, and they do not say what the contract between you and a customer must hold. ENISA says its publication does not endorse a regulatory obligation.

This pack does not say which certificate, report or form meets a requirement of NIS2, DORA or the GDPR. Each reference says what its source asks of the customer or the provider and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.