For anyone with a bid deadline
What a supplier security questionnaire actually asks
A larger customer has sent you a spreadsheet and it's due Friday. Here is what's on it, what they're actually looking for under each question, and what a good answer sounds like when the honest answer is no.
The whole page is here. There's nothing to sign up for.
No form, no email address, no download. If it's useful, use it. If you want somebody to go through your answers with you, get in touch, and if you'd like to know what a stranger can already see about your site, try the three free checks, which need no permission from anyone.
One thing worth saying before the list. Nearly every question below can be answered honestly with "no, and here's what we do instead". Buyers are used to that. What loses the bid is a confident answer that turns out to be untrue when somebody checks.
Ten questions
The ones that come up almost every time
1. Do you hold Cyber Essentials?
Often the first question and sometimes a hard gate, especially for public sector work. What they want to know is whether an independent body has looked at your basic controls. It's issued by IASME through its certification bodies, so no supplier can grant it to you or to themselves. If you don't hold it, say when you intend to, and say what you already do that the scheme asks for.
2. Where is our data held, and does it leave the UK?
They're checking whether they need to do anything extra under UK data protection law, and whether your answer matches your own privacy notice. Name the country and the region. "The cloud" is not an answer, and it reads as though you don't know.
3. How long do you keep our data, and what happens when we stop working together?
They want a period and a process, not a promise. The strong answer is a stated retention period, a route to deletion on request, and an honest note about anything you're legally required to keep, such as invoices.
4. Is multi-factor authentication turned on, including on email?
This is the question with the highest ratio of importance to effort on the whole form. Email is the one that matters most, because an inbox is how somebody resets every other password you own. If it's on, say so plainly. If it's on for some accounts and not others, say which.
5. How do you keep software patched and up to date?
They're looking for a rhythm rather than a product. Who checks, how often, and how quickly something serious gets applied. "Automatic updates are on, and I check monthly" is a real answer. Silence here reads worse than a modest process.
6. Do you take backups, and when did you last test a restore?
The second half of that question is the real one, and it's the half most suppliers cannot answer. A backup nobody has ever restored from is a belief rather than a backup. If you've never tested one, test one this week and then answer the question properly.
7. How is your website or application tested, and how often?
They want to know that somebody looks, on a schedule, and that findings get fixed rather than filed. Be precise about what kind of testing it is, because the words are not interchangeable and a buyer who knows the difference will notice if you blur them. Say who did it, when, and what changed as a result.
8. Have you had a security incident, and how quickly would you tell us?
Two questions wearing one coat. The second half is the one they care about, because it's the part that affects them. Give a number of hours. If you've had an incident and handled it well, saying so is stronger than an unblemished record nobody believes.
9. Which other companies can see our data?
Your hosting, your email, your accounting package, your CRM, anyone you subcontract to. They need the list because their own obligations flow down to your suppliers. Most people underestimate this list badly the first time they write it out.
10. How do you remove someone's access when they leave?
A small question that tells a buyer a great deal. They're testing whether you have a process at all. If you're a sole trader, say so and say what happens to your accounts if something happens to you, because that is the version of this question that applies to you.
If it's question seven that's holding you up
Testing is the one you can fix this month
Most of the list above is process you can write down in an afternoon. Question seven is the one that needs somebody to actually do something, and it's the one buyers push hardest on, because it's the only answer on the form that produces evidence.