A cybersecurity questionnaire usually asks for a fixed set of supporting documents: an information security policy, an overview of who has access to which systems, a plan for if something goes wrong, and proof that you actually test this. In concrete terms, this often involves a policy document, a risk analysis, an incident response plan, a report from a recent penetration test (a controlled attempt to break into your systems to find weak spots), an overview of backups and recovery procedures, and proof that employees have completed awareness training.
The detail that matters most with this type of questionnaire is not the content of those documents but the date on them. An information security policy that is three years old, a pentestreport without a clear approval date, or a training overview that does not show when the last session was: these are precisely the things that a customer will object to or request updates on. The questionnaire itself often tests not only whether a measure exists, but whether it is current.
Why the date carries so much weight
A cybersecurity questionnaire tries to give a snapshot of how a supplier is positioned now, not how it was positioned two years ago. A pentest that is two years old says little about the systems that have since been updated or replaced. A policy document that has not been reviewed since a reorganisation may no longer cover the current situation. Customers who are themselves subject to oversight, for example through rules on network and information security, often pass that expectation of currency on to their own suppliers. That explains why a portal sometimes explicitly asks for a validity date alongside the document itself.
For companies that fall under the NIS2 Directive, or that do business with an organisation that does, these supporting documents often recur in a fixed layout of measures. What that directive specifically asks for and for whom, you can read in the knowledge base; this article is about the documents themselves, not about the scope of the rules. the knowledge base with explanations by subject provides an overview of this.
What you usually do and do not need to submit
Not every customer asks for the same level of detail. A large customer with its own cybersecurity procurement department sometimes asks for the full pentestreport; a smaller customer is often satisfied with a summary or a statement that testing has been carried out and when. What you specifically need to share depends on the portal and the questionnaire of that particular customer. It is not customary to share source code, password policy in detail, or internal network diagrams; that information typically does not belong in a supplier questionnaire and a diligent customer will not ask for it either.
One file, multiple questionnaires
The difficulty with these documents is not that they are missing, but that they are scattered: the policy with IT, the training overview with HR, the pentestresult with the external party that conducted the test. At the next questionnaire, you gather them together again, and check once more whether the dates are still correct. A central supply chain file keeps these documents and their validity date in one place, so that when you receive a new questionnaire you can see which answers are still current and which are due for an update. Supplia fills in the questions in your customer's list based on this; you confirm each answer, and submit it yourself to your customer's portal.
Whether your company is currently missing documents that are frequently requested, you can quickly see with the free check that shows you in a few questions where you stand. How the data in such a file is handled and protected, you can read on the page on privacy and data protection. And if you want to know how Supplia arrives at the answers it fills in for you, that is explained at the explanation of how the system works.
For your own company's situation, with your own systems and risks, a conversation with a specialized IT security expert or lawyer remains the most reliable advice. This article provides an overview of what is often asked, not an assessment of what is necessary or sufficient in your case.
Would you like to see which documents at your own company are already in order and which need an update? Do the free quick-scan or browse through the topics in the knowledge base to see what is relevant for your situation.