Imagine a plant-service customer asks how you protect the accounts and job information used on their work. Your office manager needs answers from IT, approval from the owner, and a response before the deadline. This is an illustrative situation, not a customer case study.
The aim is to give the customer accurate answers while keeping estimates, scheduling, and employee support moving. A fabrication shop or industrial logistics business can use the same approach for a request about drawing access, dispatch accounts, or shipping records. Answer for the work and systems actually in scope.
01Clarify the request before collecting screenshots.
Confirm the sender, deadline, relevant work, and the systems and information covered by the request. Ask unclear questions through the agreed private channel before your team collects evidence. Knowing whether the customer means one project folder or every business system helps avoid gathering the wrong material and doing the response twice.
02Name the people who can approve the answer.
Give the office or operations manager one person to coordinate the response. Name the owner who approves it and the people who can check each business system. That keeps the request from circulating between the shop, field supervisors, and vendors without an answer. Keep confidential customer instructions and evidence out of public contact forms.
03Separate verified facts from intentions.
For each question, record the relevant system, available evidence, date checked, and person who checked it. Label an item as observed, reported, planned, or not verified. If nobody has checked a backup restore, do not describe it as a tested recovery capability.
04Give each gap an owner and a next step.
Record what is missing, who will investigate, and when the answer is needed. Raise questions early if they could affect the response deadline. Ask the appropriate specialist about contract interpretation, safety requirements, or industrial control systems; business-IT evidence does not establish those approvals.
05Review the response as a business decision.
Have the authorized approver review the answers and attachments before sending them. Share only the evidence needed through the approved channel. Keep the submitted version and a list of open actions so the next request does not start from memory.
THE USEFUL QUESTION
Make the next customer request less disruptive.
Keep a simple list of the questions, agreed scope, dated evidence, open items, and owners. It gives your team a starting point for the next request and makes unfinished work visible. An organized response does not establish certification or guarantee customer acceptance.
NIST’s Small Business Quick-Start Guide provides a starting point for cybersecurity risk management. The actual customer request determines what this particular response needs to address.
Customer security requirements and evidence support scope →
Discuss a customer security requirement