The question is no longer whether your security is adequate. It is whether you can evidence that your suppliers’ security is adequate — on a form, by a date, to a customer who will otherwise buy elsewhere.
There is a particular email that has started arriving at mid-market businesses with some regularity. It comes from a customer, usually a larger one, usually attached to a renewal or a new contract. It contains a spreadsheet with somewhere between forty and three hundred questions about security, and a deadline.
The first time it arrives, it is treated as an administrative nuisance and handed to whoever seems most likely to know. The second time, from a different customer, in a different format, asking overlapping but not identical questions, it becomes clear that this is not an administrative nuisance. It is a commercial requirement that has quietly become a condition of doing business.
Where the pressure is actually coming from
It is tempting to read this as regulation arriving by the back door, and partly it is. NIS2 obliges in-scope organisations across the EU to manage supply chain risk and vendor security, and it does so in a way that pushes obligations downstream. A UK mid-market supplier is not itself an “essential” or “important entity” under that regime — but if it supplies one, the requirements arrive anyway, in contract form, because its customer has to demonstrate that it assessed them.
Regulation is only part of it. Insurers ask. Enterprise procurement asks. Anyone handling regulated data asks. And the questions have moved from “are you secure” to “how do you assure the people you depend on”, because third-party relationships now account for a majority share of enterprise cyber risk, and the buyers know it.
60%+
of enterprise cyber risk is now attributed to third parties, which is why the questions have moved from your controls to your suppliers’
What is actually being asked for
The specific questionnaires vary and the underlying expectations do not. UK business-to-business cyber clauses for tier-one suppliers have converged on a recognisable set:
- Minimum technical controls — multi-factor authentication, endpoint detection, encryption in transit and at rest
- A recognised certification, typically Cyber Essentials Plus or ISO 27001 as a floor
- A breach notification window, commonly 24 to 72 hours
- Audit rights, and an agreed frequency for reassessment
- Approval and notification for sub-processors
- Evidence of staff awareness training
- Cooperation during incident response
- Data return or destruction at contract end
- Indemnification where a failure of the stated controls causes loss
Read that list as a supplier and it is a compliance exercise. Read it as a customer and it is a description of what you would want to be true of anyone holding your data. The uncomfortable part for a mid-market business is the sub-processor line, because it converts the whole list into a question about your own supply chain rather than your own estate.
Most firms can describe their own controls. Very few can name every third party with access to their customers’ data, which is the actual question.
Why the answer is usually not to hand
The obstacle is rarely that controls are absent. Mid-market businesses generally have multi-factor authentication, generally encrypt things, generally train people. The obstacle is that nobody owns the evidence.
Three gaps recur.
There is no supplier register. There is a purchase ledger, which is not the same thing. The purchase ledger knows who is invoiced; it does not know which of them can read customer data. Free tools adopted by a team without procurement’s involvement do not appear at all, and they are precisely the ones a questionnaire is designed to surface.
Controls exist but are not evidenced. “We do access reviews” is not an answer. “Here is the last four quarters of access reviews, signed off by the system owner” is. The difference is not security posture. It is whether anyone made the evidence a by-product of the process rather than something to be assembled retrospectively under deadline.
Nobody owns the response. The questionnaire lands with sales, who forward it to IT, who answer the technical half and guess the rest. The guesses are the risk. A wrong answer given in good faith is a contractual misrepresentation, and the indemnity clause at the bottom of the list is what gives it teeth.
The version that is worth doing anyway
The instinct is to treat this as pure cost — a tax on selling to larger customers. That is understandable and it undersells the position.
A business that can answer the questionnaire quickly and completely has a genuine commercial advantage, because most of its competitors cannot. Procurement cycles stall on exactly this, and a supplier who returns a complete pack in three days while the alternative takes six weeks has removed a reason to be deselected. For firms selling into regulated sectors, it is increasingly the difference between being on the panel and not.
It is also, unavoidably, just good practice. The register of who can reach your customers’ data is worth having whether or not anyone asks for it.
What to have ready before the questionnaire arrives
- A supplier register that lists, for every third party, what data they can reach and under what contract — built from access, not from the purchase ledger
- Your certification position, and a decision about the gap if you hold neither Cyber Essentials Plus nor ISO 27001
- Evidence, not policy: the last four quarters of access reviews, training completion, and patching records
- A named owner for questionnaire responses, with authority to say “we do not do that” rather than guess
- A standard response pack covering the recurring 80%, so each request is an edit rather than a project
- Your own breach notification commitment, agreed internally before a customer sets it for you
The part that catches people out
The deadline is not set by a regulator, which is what makes it awkward. Regulatory deadlines are published years ahead and can be planned for. This one arrives attached to a renewal, with a fortnight to respond, from a customer who is not especially interested in whether the timing is convenient.
That is the argument for doing the work now rather than when it is asked for. Not because the requirements are onerous — for most mid-market firms they are not — but because assembling evidence under a commercial deadline is where the guessing starts, and the guessing is the part that carries a liability.