Download the one-page customer security response checklist (PDF), or use the accessible checklist below.
A customer is asking security questions your team cannot answer confidently. Use this checklist to organize the facts, assign owners and decide what you can responsibly commit to before you submit a questionnaire or promise new work.
Use it with the people who own the service, the customer relationship and the relevant controls. No email address or call is required to use this resource.
Coordinator: __________ Customer and service: __________ Requested date: __________
Clarify the request
- Confirm the service, systems and customer information in scope.
- Identify the customer's reviewer, the decision waiting and the requested deadline.
- Clarify mandatory requirements, acceptable evidence and ambiguous questions.
Establish the facts
- Ask the responsible owner what operates today and where it applies.
- Check supporting evidence, its date and its limitations.
- Classify each unresolved item: missing evidence, unclear scope, partial capability or missing capability.
Decide the next action
- Choose: demonstrate, clarify, implement, propose an alternative, change scope or decline.
- Assign an owner and resources before promising work or dates.
- Keep current capability, approved plans and customer acceptance separate.
Review and submit
- Have factual owners review answers and authorized owners approve commitments.
- Remove unnecessary sensitive details and use an approved exchange method.
- Explain qualifications; do not force an unsupported yes into a restricted field.
- Save the submitted version and agree who tracks open items and the next update.
For each unresolved question, record: current answer | evidence | gap | owner | next action | date.
Before submission: Can the relevant owner support every material claim, and has every new commitment been authorized?
Prepared by Tyson Martin, Founder & CEO, CTO Input. Working checklist; tailor it to the customer's requirements and your service.