Supplier Security Questionnaire: What It Asks and How to Answer It

A supplier security questionnaire is a list of questions a customer sends to a supplier to check how well it protects data and systems before signing a contract, or at each renewal. If you sell to larger firms, councils or the NHS, you will meet one sooner or later. This guide explains what is in them, how to answer honestly without losing the deal, and where a penetration test fits.

What is a supplier security questionnaire?

It is a form, and a supplier security questionnaire can run from ten questions to several hundred. A buyer wants to know whether handing you its data, or connecting you to its network, adds risk. So it asks about your policies, your people and your technology, and sometimes asks for proof.

The UK’s National Cyber Security Centre (NCSC) publishes a basic set of supplier assurance questions aimed at smaller firms new to this. It says buyers should tailor the questions to the product or service involved. Plenty of large companies skip that advice and send a 300-line spreadsheet instead.

The NCSC also offers longer guidance on assessing supply chain cyber security, written for medium and large organisations. It is a useful read if you want to understand the buyer’s side of the table.

Why do customers send a supplier security questionnaire?

Because a supplier’s weakness quickly becomes the customer’s problem. If your systems are breached, the attacker may reach the data you hold for them, or use your access to move into their network. Buyers also face their own duties under data protection law and sector rules, so they must show they checked.

The NCSC points out that the evidence a buyer needs should match the risk. Factors include whether the supplier connects to the buyer’s IT, how sensitive the data is, and whether the supplier is a single point of failure. A cleaner who never touches a laptop should get a lighter form than your cloud hosting provider.

What questions are on a supplier security questionnaire?

Every buyer words things differently, but the themes repeat. Expect most of these:

• Governance: who is responsible for security, and do you have written policies?
• Access control: who can reach customer data, and do you use multi-factor authentication?
• Patching and configuration: how quickly do you fix known flaws?
• Data handling: where is data stored, how is it encrypted, and when is it deleted?
• Incident response: what happens if something goes wrong, and how fast would you tell us?
• Staff: do you vet and train people with access to our data?
• Testing: do you have independent security testing, and can we see a summary?

Cloud and software suppliers often get a standard template. The Cloud Security Alliance’s Consensus Assessments Initiative Questionnaire (CAIQ) is a set of yes/no questions that documents the security controls in cloud services. Buyers also use it to compare providers. If you sell software, answering it once and reusing the result saves a lot of time.

How do you answer a supplier security questionnaire well?

Start with honesty. A confident “yes” that you cannot back up will cost you more than a plain “not yet, here is our plan”. Buyers read hundreds of these, and they spot padding quickly.

1. Read the whole form first. Many questions overlap, so one good answer can cover several.
2. Give one owner. Someone technical should lead, with sales and legal checking the wording. The NCSC suggests the IT team leads, working with business, procurement and security colleagues.
3. Answer what is asked. If the question is about multi-factor authentication on email, do not describe your whole identity setup.
4. Attach evidence where you have it. Policies, certificates and test summaries carry more weight than a tick box.
5. Keep a master copy. Store approved answers so the next form takes hours instead of days.
6. Flag gaps with a date. “Not in place, due next quarter” is a credible answer. Silence is not.

Which certifications help with a supplier security questionnaire?

For many UK buyers, Cyber Essentials is the first thing they look for. The NCSC describes it as the minimum standard of cyber security the government recommends for organisations of all sizes. It rests on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Certification combines a self-assessment with an independent audit, and prices start at £320 plus VAT according to the NCSC’s Cyber Essentials overview.

Cyber Essentials Plus covers the same controls but adds independent technical testing to check they work in practice. Our guide to Cyber Essentials versus Cyber Essentials Plus explains which one a buyer is likely to want.

Other certificates, such as ISO 27001, answer many questions in one go, though they take longer to earn. Our note on what ISO 27001 auditors expect from testing covers that side.

Where does a penetration test fit in?

Most forms eventually ask whether an independent party has tested your systems. A self-assessment says what you believe. A penetration test shows what a skilled attacker can actually do, and that is why buyers ask for it.

Be ready for follow-up questions. When was the last test? Who did it? Did it cover the systems that hold our data? Were serious findings fixed and retested? A test from three years ago on a different version of your product will not reassure anyone.

You usually do not hand over the full report, because it describes your weak points in detail. Most suppliers share an executive summary or a letter of attestation instead. We cover what a good one contains in our guide to what a penetration test report looks like.

If a customer has started to write testing into contracts, read how third party testing requirements are set before you agree to terms you cannot meet. And if you are unsure whether you need a test at all, our plain guide on whether you need a penetration test is a good place to start.

If a form has asked for evidence you cannot yet show, Aardwolf Security can scope a penetration test around the systems your customer cares about and give you a summary you can send back. You can get in touch to talk it through.

What are the limits of a supplier security questionnaire?

They are a snapshot. The NCSC is blunt about it: answers reflect a moment in time and need updating. It also warns, “this is not a check list. A box ticking approach often leads to a false sense of cyber security.”

That cuts both ways. If you are the buyer, a clean supplier security questionnaire does not prove a supplier is safe. If you are the supplier, a clean form does not prove you are. The questions only help if the answers describe what really happens on a Tuesday afternoon, not what the policy says should happen.

Both sides also feel the weight. Suppliers often receive overlapping questions from many customers, and the NCSC asks buyers to keep requests in proportion to the risk. If a request looks excessive, ask politely whether an existing certificate or report will do.

Supplier security questionnaire FAQs

How long does a supplier security questionnaire take to complete?

It depends on the length of the form and how much of the material already exists. With policies written and a master set of answers, a short form can take an afternoon. A long one, with no groundwork done, can take weeks, which is why building the master copy pays off.

Can we refuse to fill in a supplier security questionnaire?

You can, but you may lose the contract. A better move is to offer existing evidence, such as a certificate or a test summary, and ask which questions it leaves open.

Should we share our penetration test report?

Usually a summary or attestation is enough. The full report lists your vulnerabilities, so share it only under a non-disclosure agreement, and only when the buyer has a real need.

Who should sign off the answers?

Someone senior enough to be accountable. A wrong answer in a signed form can become a contract problem later, so legal and security should both read it.

What if our answers reveal a gap?

Say so, and give a date for the fix. Buyers expect imperfect suppliers. What they do not accept is a gap that was hidden.