A big customer, or the bank you supply, has sent over a security questionnaire. It runs to dozens of questions, some of the language is unfamiliar, and there is a quiet implication that the contract, or the renewal, depends on getting it right. If your first reaction is a mix of irritation and mild panic, you are in good company. The good news is that these requests are predictable, they are answerable, and handling one well can actually strengthen the relationship. This article explains why the questionnaires arrive, what the sender is really checking, and how to respond credibly and fast.
Why this is happening now
Two forces are pushing security questionnaires down to smaller suppliers. The first is that attackers increasingly get in through the supply chain, so your customers are being told, by their own auditors and regulators, to check the security of the firms they rely on. The second is regulation. In financial services, rules such as the EU’s DORA and the UK’s own operational resilience regime require regulated firms to manage the risk from their technology suppliers, which means asking suppliers to prove their controls. The breach numbers keep the pressure on: the government’s most recent survey found 43% of UK businesses reported a cyber breach or attack in the last year (DSIT, 2025/2026). Your customer is not singling you out. They are doing what they are now obliged to do.
What they are really checking
Behind the length, most questionnaires are testing a handful of things. They want to know whether someone is clearly accountable for security, whether you have the basic controls in place, whether you could detect and respond to an incident, and whether you could recover. In the language of the six-function framework we use, they are probing Govern, Protect, Detect, Respond and Recover, dressed up in different formats. Common themes include:
- Access control: multi-factor authentication, limiting administrator rights, removing leavers’ accounts.
- Patching and configuration: keeping systems up to date and not running unsupported software.
- Backups and recovery: automatic backups, an offline or immutable copy, and evidence you have tested a restore.
- Incident response: a written plan, defined roles, and knowledge of your legal reporting duties.
- Governance and suppliers: a named owner, current policies, and a handle on your own third parties.
Whether you hold Cyber Essentials often comes up early, because it is a recognised shorthand for the basics being in place.
How to answer credibly and fast
The instinct is to answer each question in isolation, which is slow and produces inconsistent, defensive-sounding replies. A better approach is to prepare once and reuse. Three things do most of the work:
An evidence index
A single, organised list of your key documents: policies, your Cyber Essentials certificate if you hold one, your incident response plan, backup and restore evidence, and your asset and supplier lists. When a questionnaire asks a question, you point to the evidence rather than composing a fresh answer from memory. This is also what an auditor or a serious customer actually wants to see.
A prepared question set
Most questionnaires overlap heavily. Once you have answered one thoroughly, you have answered most of the next one. Keep a maintained master set of your standard answers so each new request is an editing job, not a research project.
An executive summary
A short, confident cover note that states who owns security, which frameworks you align to, and where you are on your improvement journey does more to build trust than a hundred ticked boxes. It signals maturity, and it frames any gaps as things you are managing rather than things you are hiding.
Mistakes that cost you the deal
A few avoidable errors turn a manageable request into a lost contract. The first is guessing. Ticking yes to a control you do not actually have looks fine until a follow-up audit or a real incident exposes it, and that damages trust far more than an honest gap would have. The second is silence: leaving a questionnaire for three weeks because it feels daunting signals disorganisation to a customer who is watching how you respond. The third is over-claiming in the executive summary. Senior security readers can tell the difference between a firm describing its real posture and one reaching for buzzwords. Answer honestly, answer promptly, and frame the gaps you do have as things you are actively managing.
When the deal is stuck
Sometimes the questionnaire lands at the worst moment, the deal is close, and you do not have the evidence to hand. This is exactly the problem our Trust Pack is built for. In a 48-hour turnaround we produce a completed questionnaire response, an organised evidence index and an executive summary, so a stalled deal moves again without you dropping everything for a fortnight. Fixed fee, no surprises.
How this maps to the TrustOps Maturity Model
Being able to answer a security questionnaire quickly and honestly is a Level 3 (Managed) signal: policies live, evidence organised, a named owner. Firms at Level 1 or 2 can usually still pass, but only after a scramble. The lasting fix is not a better spreadsheet on the day. It is having your posture visible and current, so the next request is a five-minute export, not a fire drill. Every engagement starts by locating you on the model and ends with a measurable move up.
If you are not sure where you stand today, the honest first move is to find out. Our free 15-minute assessment scores you out of 100 against the same six functions, shows your top five gaps, and gives you a maturity level you can act on, whether or not we ever speak again. Start with the free assessment at trustops.co.uk.
Sources
DSIT – Cyber Security Breaches Survey 2025/2026 (43% of businesses reported a breach or attack; supply-chain and phishing findings): https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
NCSC – Supply chain security guidance: https://www.ncsc.gov.uk/collection/supply-chain-security
ESMA – Digital Operational Resilience Act (DORA) (third-party risk drivers behind supplier questionnaires): https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora
