The customer needs an answer. You need the evidence.
A PQQ or assurance question can cross project teams, IT and outside providers. Use a clear request, a worked access record and a worksheet that keeps the answer and evidence together.
YOUR WORKING GUIDE Guidance + fillable worksheet ↗Give the technical owner
a question they can answer.
A current policy describes the intended process. A supportable answer also needs a clear scope, the person operating the control and evidence of what happened.
You own the return.
You don’t have to own every system.
Attach the customer’s actual question and adapt this request for IT, the project owner or the provider holding the evidence.
Keep supporting records in the agreed secure location. A reference can establish where the evidence is held without putting sensitive material in another email chain.
“We’ve removed access”
needs a clear boundary.
In this illustrative record, your IT team has completed its action. A client-controlled portal still needs confirmation. Both facts belong in the answer.
A record you can follow
Withdrawal
IT confirms removal of the relevant folder permissions. The client portal request is still awaiting confirmation, so the overall record stays open with a named follow-up owner.
- Responsible owner
- IT + client administrator
- Evidence reference
- IT-042 / CR-009
- Status
- Client action pending
The example and references are illustrative. Ask for the actual approver, date, scope, review and completion record for your own arrangement.
Download the blank evidence registerCheck Cyber Essentials and certification scope
Scope first.
Then the evidence.
Check the requirement, the systems it covers and the certification already held before asking for additional work.
Device ownership changes the scope question.
Cyber Essentials v3.3 distinguishes employee-owned work devices from devices owned by third-party contractors. Accounts your organisation provides to third parties remain in scope. Agree your specific assessment boundary with your certification body.
Read the NCSC requirementsExisting certification may affect what is needed.
In version 5, question 161 exempts valid Cyber Essentials Plus or qualifying ISO 27001 holders from questions 163–169. Check the stated accreditation conditions; basic Cyber Essentials is not the listed exemption. Version 6 is announced for 1 November 2026, so confirm the applicable question set with your assessment body.
Check the current Build UK guidanceThree device arrangements to distinguish
- Employee’s own work phone
- In scope, except devices used only for native calls, texts or MFA.
- Contractor’s own device
- Outside device assessment scope. Your organisation’s accounts remain in scope.
- Your device, loaned out
- Include it in the assessment. Out-of-scope devices still need appropriate configuration.
Technical references checked 21 October 2026. Review the assessment note when version 6 is published.
Construction assurance evidence guide
A request to forward, a worked example, a fillable evidence record and the scope distinctions to check.
Download the guide & worksheet ↓Before you take
the next step.
Is a security policy enough evidence?
It explains the intended process. Depending on the actual question, you may also need a scoped example showing approval, review or withdrawal. Ask the control owner what the evidence establishes and what remains qualified.
Does HSEQ have to administer the controls?
The person coordinating the assurance response may not operate the systems. A clear request should identify the technical owner, the scope of their confirmation and the evidence behind it.
Will the diagnostic assess our certification or PQQ?
No. It explores communications and mobile-access arrangements. A particular certification, contractual or customer question needs to be considered against its own scope and requirements.