A customer sent you a security questionnaire. Now what?

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

1. Why customers keep sending you 80-question spreadsheets

If you sell to banks, law firms, housing associations, NHS trusts or large corporates, their procurement and risk teams have to prove to their own auditors and insurers that third-party suppliers won’t be the weak link. Initiatives like the Government Cyber Resilience Pledge (delivered with IASME) also commit large organisations to actively track Cyber Essentials adoption across their supply chains.

2. Which questionnaire sections Cyber Essentials answers outright

Most supplier questionnaires (and the NCSC’s own supply chain security guidance) ask the same core questions:

• Do you hold a recognised cyber security certification? — Answered directly with your Cyber Essentials (or Plus) certificate number and link to IASME’s public register.
• Access control & MFA: — Covered by Control 4 (MFA on all cloud services, separate admin accounts, leavers disabled).
• Patching & vulnerability management: — Covered by Control 3 (14-day patching rule and supported software).
• Endpoint & network security: — Covered by Controls 1, 2 and 5 (firewalls, secure configuration, anti-malware).
• Written policies & asset registers: — Covered by our free Evidence pack generator (Information Security Policy, Access Control Policy, Patching Policy, Acceptable Use Policy, BYOD Policy, and Asset/Cloud Registers).

3. How to answer honestly when you aren't certified yet

Never tick “Yes” to a control that isn’t actually live — if the buyer asks for a screenshot or a certificate copy next week, an optimistic answer destroys trust. Instead, give a dated, factual answer: “In progress — we are currently completing our Cyber Essentials v3.3 preparation with AlphaSec, with certification scheduled within the next 3 to 4 weeks.” Procurement teams almost always accept a committed target date.