Find an Evidence Owner When an RFP Requests an Unlisted Attestation

An RFP can request an attestation that is absent from the response library. Under deadline pressure, writers may try to draft a plausible answer and ask information security to approve it later. That reverses the control. The RFP lead should identify the evidence gap, assign an accountable owner, and tell the prospect what can be answered within the stated process.

Capture the exact question, required form, deadline, and any definition supplied by the prospect. Search approved materials for related evidence, but do not turn a related policy into an attestation. Escalate the gap to the responsible operational or security owner and record the review path.

An RFP coordinator says, “Could you write two sentences now? Security can clean them up tomorrow.” The lead replies, “I cannot put an unsupported control statement into the response. I have separated the requested attestation from the material we can verify today. I will ask the designated security owner whether approved wording exists and let you know by the clarification deadline if we need to raise a question.” The coordinator agrees to hold the field.

The status note should show the question, evidence owner, approval deadline, and fallback action. It should not imply that silence means the attestation is true.

For practice, give a writer a tempting partial policy document. The writer succeeds by explaining why it does not answer the RFP, finding the right owner, and preserving a clean audit trail. A manager should reject language that sounds authoritative but lacks an approved source.