Template fields
A reusable answer is an approved evidence trail.
The template is a practical register, not a stock library of “yes” answers. It deliberately includes owner and reviewer fields so that the people responsible for the controls can check whether each statement is still accurate.
- Question and named control or requirement
- Approved answer and evidence reference, not unverified marketing language
- Control owner and independent reviewer where appropriate
- Evidence date, next review date and assurance scope
- Disclosure restrictions and required NDA
- Customer-specific exception and next action
An illustrative example
How to document a security claim without overstating it.
Imagine a buyer asks whether access to production data is reviewed. A strong answer would identify the relevant scope, review frequency, control owner, last review evidence and any exceptions. It would not simply say “yes” because a policy mentions access reviews.
| Field | Example — fictitious |
|---|---|
| Question | Are privileged production accounts reviewed? |
| Draft response | A periodic review is carried out for the documented production account scope; details provided subject to approval |
| Evidence | Access review record REF-AR-001 (fictional) |
| Owner | Infrastructure security lead |
| Reviewer | Information security governance owner |
| Status | Pending verification and disclosure approval |
Using AI appropriately
Use automation to locate evidence, not to make representations.
A language model can suggest which records may answer an incoming question. It cannot independently verify that a control was performed, that it covers the requested scope or that evidence may be shared. The reviewer has to validate those facts.
For commercially sensitive information, use only approved systems and contracted processors. Do not paste access inventories, vulnerabilities, policies or customer confidential data into public tools without a security and contractual review.
What to do with exceptions
An honest exception is better than a fictitious control.
If the organisation cannot meet a buyer requirement, record the gap and obtain the correct risk, legal and commercial approval before describing a compensating measure or remediation date. Maintain one authoritative statement for each material commitment.
A source-of-truth rule
What makes an answer reusable across customers?
Approve statements at the level of a specific claim rather than copying an entire past questionnaire. 'MFA is enabled' needs a system scope, user population, policy exception status, reviewer and evidence date. A new customer may ask a different question about the same control, but an old answer cannot be adopted without checking those fields.
A simple rule is to treat any answer as expired whenever its source changes, its approval lapses, the requested recipient differs in permission or the contract imposes a new commitment. The worksheet should keep these triggers visible.
Primary references and further reading
These public references inform the topic; they do not constitute an endorsement or review of our services.
Editorial content reviewed: 12 October 2026. Specialist technical review is required before applying this guidance to a real environment.Put this into practice