Checklist: being ready for supplier and security questionnaires
For: Management, IT and sales at suppliers
Updated: 2026-11
Suppliers receiving security questionnaires should be prepared: one responsible person, current core documents on security and data protection, a list of their own providers, evidence for backups and access protection, an answer library and a clear rule on how gaps are handled.
Since NIS2 and DORA, many companies must demonstrate the security of their suppliers. The questionnaires are very similar, even though each customer has its own format.
Preparing the foundations properly once makes new questionnaires quick and honest to answer.
The checklist
- 01
Assign responsibility
One person coordinates questionnaires and has access to all required information.
Done when: The responsible person is named and known to sales.
- 02
Update core documents
Bring the security policy, incident plan, data protection documents and permission concept up to date.
Done when: The documents carry a current date and match actual practice.
- 03
List your own providers
Record cloud services, data centres and IT providers with location and contracts.
Done when: A list of sub-processors with storage locations exists.
- 04
Provide evidence
Collect evidence for multi-factor authentication, backups, updates and access protection, such as configuration extracts or test records.
Done when: Concrete evidence exists for the most frequent questions.
- 05
Build an answer library
Write standard answers to recurring questions and link them to evidence.
Done when: The library covers the most common topics and is accessible to all involved.
- 06
Regulate the handling of gaps
Decide that gaps are named openly and answered with planned measures and dates.
Done when: The rule is documented, and embellished answers are ruled out.
Common mistakes
- —Answers are embellished and later written into contracts as obligations.
- —Different people answer similar questions differently.
- —Evidence is missing even though the measure is actually in place.
What this checklist does not cover
- —The checklist does not verify whether the measures described are actually effective.
- —Contractual commitments should be legally reviewed before signing.
Parent service: Cyber readiness & IT security
Matching offers
Answering customer security questionnaires
Under NIS2 and DORA, large customers must assess their suppliers’ security and send extensive questionnaires to do so. We help answer them honestly and completely, compile the evidence required and build an answer library so the next questionnaire takes hours rather than days.
Building an ISMS to ISO 27001
An ISO 27001 ISMS is the solid foundation for NIS2, TISAX, customer requirements and possible certification. We build it to fit your company: scope, risk assessment, statement of applicability, policies, responsibilities and internal audit. The certification audit is carried out by an accredited body.
FAQ
How long does a questionnaire take without preparation?
Often several days spread across different people. With an answer library, the effort drops considerably.
What if we cannot answer a question positively?
Answer honestly and state which measure is planned by when. Customers value transparency more than a gap they discover later themselves.
More checklists
Checklist: taking out cyber insurance without jeopardising cover
Cyber insurance is taken out properly in seven steps: clarify needs and risks, implement the baseline measures the insurer requires, answer the questionnaire honestly and checked by IT, compare cover and limits, understand exclusions, add emergency rules to the incident response plan and keep evidence current.
Checklist: securing MCP servers and AI agents
An MCP server is secured in seven steps: narrowly limit the use case, grant least privilege per tool, use dedicated credentials instead of shared accounts, tie consequential actions to human approval, treat content from external sources as data, log all calls and introduce new servers through an approval process.
Checklist: creating a first business continuity plan
A first business continuity plan is created in seven steps: identify critical processes, assess the impact of an outage, set recovery objectives, describe fallback procedures for each critical process, make contacts available offline, exercise the plan and update it regularly.