Last year this company received thirty one security questionnaires from customers and prospective customers. The shortest had forty questions. The longest had just over four hundred, arrived with a fortnight's deadline, and took four people three weeks. Two customers sent somebody to visit. Three asked for evidence we could not produce in the form requested: a penetration test inside the last twelve months, a signed continuity test report, and a named security officer, which in this organisation is me wearing a different hat.
None of that work appears anywhere. It is not a project, it raises no tickets, and it is invisible in the capacity report I take to the committee every month, which means that for two years I described my department's workload in good faith and left several hundred hours out of it.
It has also cost us money. A tender worth about one and a half million over four years went in two days late, because the questionnaire sat in my inbox during a week in which our carrier integration was down. Another customer's procurement portal had a fourteen day response window we discovered on day nine, because the notification went to a sales colleague who did not know what he was looking at.
What we do now is dull and it works. There is an evidence pack, versioned and reviewed quarterly, holding our policies, our certification, an architecture summary, the list of suppliers who process data on our behalf, continuity test results and insurance details, from which about seven tenths of any questionnaire can be answered by somebody who is not me. It has a named owner with four hours a week set aside for it. I sit in the bid or no bid meeting now, so the first my department hears of a tender is not the week it is due. And we bought the certification two large customers kept asking about, which turned out to be cheaper than answering the questions by hand.
The questionnaires have been useful in one respect I have stopped being sheepish about. Two things I had failed to get funded were funded within a month of a customer asking about them in writing.
Assurance has become part of how this company sells. It was still being done in the evenings by whoever happened to open the email.
– Serguey Shinder
Top comments (0)