3

I mean this in general terms but as an example today I got a request from a clients ISP asking them to fill in a survey detailing their server backup processes and software and their server antivirus information.

To which I replied: "Sorry, it's a secured network, any information concerning the servers, company protocols, procedures and security measures are not for random distribution. Please don't ask again. Have a good day."

There was a couple of other emails, but nothing with a better reason than "survey, so we can focus on our staff training to provide better services" and currently I'm just ignoring them.

I am authorised to liaise with third parties on any IT related matters, although I am not an employee.

Is there a better way to handle these sorts of requests?

  • 5
    "Distribution of that information would be a violation of our operational security policies" The more formal and professional the language, the better. – John Feltz Nov 16 '16 at 22:49
  • 1
    @JohnFeltz Very good point on the formal language. English isn't a first language here so I worded it less formally,but in hindsight it's not my problem if they don't understand. – Kilisi Nov 16 '16 at 22:56
  • It would be a good idea to mention that to your client (you mentioned you are not an employee) that such requests were made by their ISP I would - as a imaginary client, for sake of example - like to be able to get in touch with someone but with your adequate response to their silly question it might not be necessary. – Cthulhubutt Nov 17 '16 at 12:16
  • @Cthulhubutt yes, I actually cc'd the client, it's a bad idea not to keep them in the loop. – Kilisi Nov 17 '16 at 12:31
  • 1
    @Kilisi All the corners covered then, nothing to worry about as far as you are concerned. With these kind of requests being to the point, firm and not leaving any ambiguity is the way to go. – Cthulhubutt Nov 17 '16 at 12:34
3

You handled it fine. If you choose not to fill out the survey, somebody else will and your client's ISP is still going to be happy.

Your language is direct, but so is mine. You drove across the point that you are not cooperating - when the answer is "no", it's best that the "no" comes as unambiguous as possible.

Our subordinates may have a different communications style - that's fine as long as the style works for them and they get our point across.

  • 2
    I think so too, and if someone else does fill in the survey, I'll get them sacked for breaching security. – Kilisi Nov 16 '16 at 23:38
  • I would also report it to whoever handles your IT security as a possible phishing or social engineering attack. Anyone else who receives such an email may unwittingly respond to it - better to broadcast the fact to everyone that such emails should not be responded to and put the company on alert. – toadflakz Nov 17 '16 at 9:25
2

In the general case, if it's from someone sketchy and/or don't recognize at all, report it as spam to the FTC and/or make use of whatever mechanisms exist in your country and block them.

If it's from someone you don't care about: It's OK to just ignore the email.

If it's from someone you recognize, someone you have or would like to work with and/or someone you want to have a good opinion of you, then a polite email explaining that you can't give out that information is sufficient.

In any case, block them if you keep getting messages from them. A reasonable person working at a reasonable business will respect the fact that you don't want to tell them. Someone who responds to, "Please don't ask again." by making the same request over and over again is either a bot or working for a business that thinks harassing someone via email will get them to change their mind.

In this specific case, since they're doing a survey, there's a good chance no one even saw your response. They can just tell that the survey hasn't been filled out and it's automatically sending an email to everyone who didn't do the survey until the survey period ends. I don't think there's a better way of handling this since attempting to get off of whatever list you're on is almost certainly more trouble than it's worth.

1

"Apologies, but I am not in a position to share this information."

Or

"I am not authorized to share this information, please contact our media/customer support/HR team."

Or

"I am bound by a non-disclosure agreement with respect to all company data; please contact..." as above.

Generally it is good to provide contact to someone who is authorized to speak "officially" in your employer's name so whoever is contacting you is assured that they won't get their hands on certain data.

  • I am the authorised person, I'll add that to the question. – Kilisi Nov 16 '16 at 22:59
  • 1
    I think that is the wrong approach. You are telling them that there is someone who can give that information, which just leads them on a wild goose chase and wastes everybody's time. "Sorry, but our company doesn't wish to share this kind of information" is polite and tells them that they don't need to try further. – gnasher729 Nov 17 '16 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.