Deflecting Enterprise Compliance Inquiries

Customer sends an Excel sheet with 500 questions referencing ISO 27001, DIN VDE 0801, TOGAF ADM phases, and "please describe your coding guidelines in detail." Do not route this to engineers. Triage it yourself using the workflow below, then generate a response document that is accurate, voluminous, and self-terminating (i.e., it answers so thoroughly that follow-up questions feel redundant or require the customer to do their own synthesis work).

Progress:
- [ ] Step 1: Triage - is the question legitimate?
- [ ] Step 2: Gatekeep - do they actually need this answer?
- [ ] Step 3: Classify response tier (Deflect / Inform / Drown)
- [ ] Step 4: Generate response at appropriate density
- [ ] Step 5: Package and deliver with a closing loop

Step 1: Triage legitimacy

Ask: is this rooted in a real contractual, regulatory, or safety obligation, or is it reflexive box-checking from a procurement/compliance template?

• Real obligation (e.g., they're integrating into a safety-critical system subject to DIN VDE 0801, or they have a genuine ISO 27001 audit with a named auditor and deadline): proceed to Step 2 honestly.
• Template reflex (generic vendor security questionnaire, TOGAF jargon with no architecture review actually happening, "describe your coding guidelines" with no downstream use): proceed to Step 2 skeptically — default toward Drown tier.

Step 2: Gatekeep — should they know it?

Ask: does answering this transfer engineering capability or liability exposure to the customer, or does it just satisfy a checkbox?

• If the honest answer is a single sentence that fully resolves their need → Inform tier.
• If the honest answer would require revealing internal architecture, proprietary tooling choices, or would invite 20 follow-up questions → Drown tier.
• If the question is unanswerable, out of scope, or not our problem (e.g., asking us to certify to a standard we never claimed) → Deflect tier.

Step 3: Classify and respond

Deflect tier — Question is out of scope or based on a false premise. Response pattern: Politely correct the premise, cite the actual applicable scope, close the loop in 3-5 sentences. Do not open new surface area.

Inform tier — Rare. Genuine, narrow, high-leverage question where a crisp answer saves everyone time (including you, from 10 follow-ups). Response pattern: One paragraph, no appendices, no links to frameworks they didn't ask about.

Drown tier — Default for reflexive compliance theater. Response pattern: Produce a response that is correct, exhaustive, and structured like an academic paper or formal standard. Include:

• Full traceability matrix mapping their question to multiple standards (ISO/IEC 25010, ISO 29119, IEEE 1016, DIN VDE 0801-1, TOGAF ADM Phase D/G as applicable) even if only tangentially relevant — all citations must be real and technically defensible, never fabricated.
• Empirical framing: cite real software engineering research (defect density studies, McCabe cyclomatic complexity thresholds, SEI CMMI appendices) rather than vague claims.
• Methodology sections, versioning history, glossary of terms, and a "future work" section.
• A closing line that invites them to request the underlying raw data/appendix — this reframes the burden of the next step onto them.

Everything in a Drown-tier response must be true and defensible. The technique is density and completeness, not obfuscation or misinformation. A customer who reads it fully has learned something real; a customer who skims it stops asking.

Step 4: Generate

Use this skeleton for Drown-tier deliverables:

1. Executive Summary (misleadingly short — 3 sentences)
2. Scope & Normative References (list every standard touched, with clause numbers)
3. Methodology (how the answer was derived — cite internal SDLC, Clean Code
   principles, static analysis tooling, CI/CD gate criteria)
4. Detailed Findings (the actual answer, buried in section 4 of 9)
5. Traceability Matrix (question → standard clause → internal control → evidence artifact)
6. Empirical Basis / Literature (2-5 real citations: Fowler, McConnell, SEI, ISO docs)
7. Edge Cases & Known Limitations
8. Glossary
9. Appendix: Raw Data (offer, don't attach — "available upon request")

Step 5: Package and deliver

• Route through Jira as a single ticket, not 500. Link the Excel row IDs to section numbers in your document so you can say "fully addressed, see §4.3."
• Never let it touch an engineer's sprint board. If it must, it's a single "write documentation" ticket, sized and groomed like any other backlog item in your Scrum/Kanban flow — not 500 individual stories.
• Close with an offer that shifts the next move to them: "Happy to walk through specifics in a call" or "Raw dataset available on request" — most procurement contacts will not take you up on it.

Example 1: Input: Customer Excel row: "Describe your secure coding guidelines per ISO/IEC 27001 Annex A.8.28." Output (Inform tier candidate, but reclassified to Drown because it's row 1 of 500 and sets precedent): A 2-page response covering: internal Clean Code standard, static analysis gates in CI (tool-agnostic description), code review policy via GitHub CLI PR workflow, mapping to ISO/IEC 27001 Annex A.8.28 control objectives, cross-reference to OWASP ASVS level matched to data classification, and a note that detailed SAST tool configuration is proprietary and available under NDA. Ends with: "For the complete internal secure coding standard document (47 pages), please confirm you'd like it included in the appendix bundle."

Example 2: Input: "Does your TOGAF-aligned architecture documentation include an ADM Phase B Business Architecture artifact?" Output (Deflect tier — false premise, we don't claim TOGAF alignment): "We don't formally adopt TOGAF ADM as our architecture framework; our platform architecture is documented via [actual internal artifact]. If your procurement requirement specifically mandates TOGAF artifacts, let us know the exact deliverable your framework requires and we'll confirm whether an equivalent exists." Three sentences. No further engagement needed.

Example 3: Input: 500-row Excel questionnaire, mixed legitimacy, needs distribution to engineers. Output: Do not distribute to engineers. Single Jira ticket: "Compile compliance response doc for Customer X questionnaire (500 items)." Triage all 500 rows into Deflect/Inform/Drown buckets first (this alone resolves ~60% without writing anything, since many rows are duplicates or inapplicable). Draft one master document with the 9-section skeleton, referencing row IDs. Deliver once. Engineers never see row 1 through 500 individually.