Search all 586 artefacts by title, document ID or content.
Assurance
The process
If your form is a CAIQ, a CAIQ-Lite, a SIG Lite or a HECVAT, do not send it. Those workbooks are already completed and published below. Send the link to your reviewer and the round trip disappears entirely.
The form below records who to reply to, what the workbook is, roughly how big it is and when your review closes. It creates a tracked item, not an email in an inbox.
This page stores no file. You will get a reply from a person, and the workbook goes back to that address: a spreadsheet, a portal invitation, or a PDF, whichever your process uses.
Every answer carries the document ID and section it comes from. Where a question has no published answer, you get the answer and the answer is then published here, so the next hospital never has to ask it.
Already completed
These are generated from the same source as every answer on the answers page. They are not a separate document set maintained in parallel, which is why they cannot drift from the policies they describe. The self-assessed CAIQ and CAIQ-Lite are public and need no gate at all; the licensed and derived packs sit behind the mutual NDA and an approved access request.
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: four business hours (target)
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: four business hours (target)
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: four business hours (target)
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: four business hours (target)
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: four business hours (target)
Commitment
| What arrives | What we commit to | Note |
|---|---|---|
| Acknowledgement, from a person | Same business day | Including a named owner and, where the workbook is large, the date you will have it |
| CAIQ, CAIQ-Lite, SIG Lite, HECVAT | By return | Already completed and published. Nothing is filled in on request |
| A bespoke questionnaire of 150 questions or fewer | 1 business day from receiving the file | The internal target for completing one is 60 minutes, by one person who is not the founder |
| Over 150 questions, or a portal with mandatory free-text fields | 3 business days | With the date confirmed on day one rather than discovered on day three |
| A question with no published answer | Answered, then published | No answer is invented and no cell is left blank. A blank cell reads as concealment |
The reason these numbers are short is not diligence. It is that the work was done before you asked: a bespoke questionnaire is mapped onto forty already-approved answers rather than written. A questionnaire round trip is the single largest recoverable delay in a hospital security review: typically five to fifteen working days of deal clock sitting in an inbox. Pensieve targets first contact to go-live in fourteen days. A fifteen-day spreadsheet does not fit inside that.
Every answer
| Their question | Our answer | Citation | Varies by model |
|---|---|---|---|
| Is data encrypted at rest and in transit? | Yes, with the algorithms, key custody and rotation stated rather than asserted. | DIS-GL-011 Section 2 | No |
| Where is our data stored? | Depends on the deployment model, and the answer differs materially between them. | DIS-GL-008 Section 1 | Yes |
| Are you ISO 27001 certified? | No. The Statement of Applicability exists and is published; the certificate does not. | WPR-GL-005 Section 3 | No |
The “varies by model” column is not decoration. Sending a DM-1 answer to a hospital deploying on its own hardware is the most damaging error available in this process. It creates a representation Pensieve cannot honour on infrastructure it does not control. Tell us your deployment model in the notes and the answers are set to it.
Intake