Main idea

An answer to a security questionnaire often mixes two kinds of material: what makes it possible to verify the answer and what can be passed on to the prospect. The detail of a backup configuration can be essential to the internal reviewer without belonging in a document sent outside.

Keeping the two apart changes the way you answer. The wording meant for the client is prepared on one side; the evidence and the caveats stay alongside, for whoever has to approve. The reviewer judges on the evidence, the prospect reads the wording, and neither receives what isn't meant for them.

Why it matters

Mixed together, the two kinds of material constrain each other: either you don't write the evidence down so as not to expose it, and the answer can't be verified; or you write it into the document, and you pass on internal information. Separation removes this dilemma.

It also makes the client wording replaceable without losing what justifies it: a new questionnaire, another format, another language reuse the evidence and only rewrite the sentence.

Nuances and limits

Two separate kinds of material can diverge: client wording updated without the evidence following, or the reverse. Separation requires keeping the link between the sentence sent and what it rests on.

Open questions

• Who decides what can be disclosed to a prospect, when the evidence belongs to a technical team and the wording to a sales team?