Playbook, online course
Six places, and a spreadsheet from somebody in security
The review is not proportionate to the purchase and it does not have to be. Somebody in an employer's security team has been handed a request to buy training, and they will work through the same template they use for anything else. They have no interest in the course, and the whole sale now rests on how fast the rows get answered.
Why this is not the general answer
The handling pattern for security questionnaires holds across every trade. What follows is the part that does not.
- The order is small and the assessment is not scaled to it, so the cost of a slow or vague answer is the entire sale, and the reviewer will never open a single module of the thing they are assessing.
- The questions are about employees rather than about company records: what is stored on somebody who takes the course, where the video is served from, how long a completion record is kept and who else touches it.
- Employers ask whether they can be shown their staff's progress and results, which is as much a question about what the learners were told at enrolment as it is a question about security, and the two answers have to agree.
- Training records are frequently wanted for the employer's own audit, so export and retention move from being features to being purchasing conditions, and both are answerable from documents if those documents exist.
How it arrives
- what do you store about each learner who takes this
- can we get completion records exported for our audit
- will you sign our supplier agreement
- do you use our staff data for anything else
- how long do you keep records after the course ends
- can we see progress for the people we paid for
What has to be indexed for this to work
| What is held about a learner, listed as fields | The actual items: name, address, progress, assessment answers, anything captured in a community. A reviewer is filling in a row about categories of personal data, and a paragraph of reassurance does not fit in that box. |
|---|---|
| The third parties involved in delivering the course | Who serves the video, who handles payment, who sends the email, and what each of them touches. Name the function and keep it dated. Reviewers ask this in every assessment and it is entirely publishable. |
| What a sponsoring employer can be shown, and what learners were told | Whether completion, progress or results are reported back, and the wording learners see at enrolment. If those two disagree, the disagreement will be discovered by a reviewer with a spreadsheet, which is the worst possible place for it. |
| Your position on signing somebody else's agreement | Whether you have your own terms for corporate purchases, whether you will review theirs, and who handles it. A small course business often has no position at all, and deciding that during a live deal is what loses it. |
The reply
The list of what is held about a learner, and the third parties involved in delivering the course, are both on our privacy page with a date on them [1]. What a sponsoring employer is shown about their own staff is set out separately, and it matches what learners are told when they enrol, which is the part worth reading if you are assessing this [2]. I cannot complete an assessment document, agree a contractual term or sign anything. If you leave your name, your work email and the company you are assessing for, the team will send whatever standard responses exist and answer the rows that are not covered here.
It answers the rows it can from published material and gives the route for the rest, which is what an assessor needs to keep moving through a template. Pointing at the learner facing wording is deliberate, because a reviewer checking employee data will look for that and is reassured by finding it first. And it never says an answer satisfies a control, which is a judgement belonging to the reviewer.
Where it stops
The trigger. Any request to complete a document, agree a term, sign an agreement, or confirm something the published pages do not cover.
Completed assessments and signed agreements come from a person rather than from here, and I cannot commit to any contractual position. Leave your name, your work email and the company you are assessing for, and the team will come back with what they have.
It stops answering before it guesses, says who will pick it up, and asks for the one thing that makes a reply possible. Nothing about it reads as a dead end.
Never say this here
Out of bounds
- Never claim a certification, audit or assessment status that your own published pages do not state.
- Never say that a given answer satisfies a reviewer's control or their internal policy.
- Never agree to a contractual term, an amendment or a data processing clause.
- Never say what an employer will be able to see about a named member of their staff, since that depends on the enrolment and on what those learners were told.
Questions
- We sell to individuals. Is this worth writing for a handful of corporate buyers?
- Those buyers are the ones purchasing several places at once, which makes them worth more than the volume suggests. And the material is the same privacy and third party detail you already owe your individual learners, written in a form a reviewer can cite.
- Can it fill in the reviewer's spreadsheet?
- No, and it should not appear to. It answers in chat with references back to your own pages, so a reviewer can verify each claim at source. Transcribing that into their template, and attesting to it, is a person's job with a person's name against it.
- What blocks these deals most often?
- The row about what the employer can see of their staff's results, because most course businesses have never written it down and the two possible answers have very different consequences. Decide it once, publish it in both places, and the row stops being a stall.
Keep reading
- Everything for a online courseWhat is included, how long access lasts, refund and cooling off rights, and the honest limit that it cannot see a learner's own progress.
- Handling security questionnaires in generalA buyer-side question arriving in the wrong place. Answer only what you publish, and never let an assistant improvise a claim you then own.
- Course refunds, where your policy is not the only rule that appliesDistance selling rules and immediate access do not sit comfortably together. State both, and the exception you rely on.
- Cancelling a course subscription, and the access question underneath itThe question underneath a cancellation is what a learner loses and when. Answer that plainly and the churn conversation improves.
- Access problems on a course platform, and which ones are answerableWrong email, expired invite, a course bought by an employer. Three access problems with three different answers.
Try it on your own material
Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.