Keep a commitments register: one row for every promise made to a customer during a security review, with an owner, a due date, a status and a link to the source. Review it monthly. Without one, promises live in email threads and are discovered only when the customer asks about them.
Where promises come from
Commitments hide in many places: a gap statement in a questionnaire, a line in a call recap, an email from sales, a contract schedule. Each says something like "we will complete X by Y". Each is a small contract in the customer's mind, whether or not it is legally one.
What the register contains
| Column | Purpose |
|---|---|
| Customer | Who was promised |
| Promise | The exact wording used |
| Source | Link to the questionnaire, email or call note |
| Owner | A role and a named person |
| Due date | The date promised |
| Status | Not started, in progress, done, at risk |
| Evidence | Link to proof when done |
| Customer informed | Date you closed the loop |
The Promise column should quote the words you used. Paraphrasing weakens it.
Steps to start
- Create the register as a shared spreadsheet or tracker with edit access limited to a small group.
- Search the last quarter of questionnaires and recaps for promise language: "will", "plan to", "by Q".
- Add each one, and assign an owner who agrees to it.
- Set a monthly fifteen minute review with security, engineering and sales.
- For anything at risk, contact the customer before the date passes, not after.
- When something is done, attach evidence and send a short written confirmation.
Rules that keep it honest
- No promise leaves the building without a register entry. Make it part of the questionnaire sign off.
- Owners confirm the date before it is sent. A sales rep cannot commit engineering time alone.
- Overdue items are reviewed first at every meeting.
- Close items only with evidence, not with a status change.
Reuse the data
The register tells you which gaps customers raise most. If five customers ask about the same missing control, that is a strong reason to move it up the roadmap. It also helps the next review: you can say what you committed to last time and show it done.
Common failure modes
The register becomes a graveyard if nobody owns it. Name one person who runs the monthly review. If promises are made in channels the register does not see, such as chat messages, remind sales and customer success that anything a customer could read as a commitment belongs in it.
Also avoid over promising to fill the register's empty rows. The purpose is accuracy, and the best way to keep the list short is to promise less and deliver all of it.
Where Safeguard fits
Safeguard's compliance and evidence automation can hold owners, due dates and supporting evidence in one place, and policies and gates can turn some commitments, such as a scan on every release, into checks that run on their own. Try the free scan at https://gold.safeguard.sh/scan.
Quick check
Do all promises belong in the register?
Yes, any statement a customer could rely on, from a fix date to a follow up report.
Who runs the monthly review?
One named owner, usually in security or compliance, with sales and engineering attending.
Last reviewed: 19 October 2026.
