The Assurance Desk
Part of the guide Customer security questionnaires: what they ask and how to answer
Is the certificate a firm requirement?
Start by asking which certificate the buyer wants and whether it is a condition of the contract. Do not treat a request for certification as the same question as whether you have security measures in place.
If the requirement is unclear, ask the buyer to explain it. The UK National Cyber Security Centre is known as the NCSC. Its guidance says suppliers should check that customers accept the measures being taken.
You still need to meet the requirements that apply to your work. A plan to improve is something to discuss with the buyer, not permission to ignore those requirements.
How should you describe a gap?
Describe a gap by separating a missing document from a missing security measure. If you cannot show that a measure works, say what still needs checking. If it is not in place, explain what can be done.
| Your position | What the reply should explain |
|---|---|
| The measure is in place | Describe what it covers and the evidence available. |
| Evidence is still being checked | Explain what is unconfirmed and when an update can be given. |
| The measure is not in place | Describe the gap and discuss an achievable improvement plan. |
| The question does not seem to fit | Explain why and ask the buyer to confirm what is required. |
What evidence can you offer?
Useful evidence includes the security policies that apply to the service and how you check that people follow them. If independent security tests have been done, discuss the findings and what was fixed.
Ask which evidence the buyer needs. The depth of the review should reflect how important your service is to them and the risks it brings. A folder of unrelated documents does not answer that question.
Build a reply the buyer can assess
- Confirm the question Ask what the buyer needs to establish.
- Describe the current position Explain the policy or security measure that applies.
- Offer relevant evidence Discuss checks, test findings and fixes.
- Confirm what remains Ask whether the buyer needs anything else.
Can you agree a plan for missing measures?
A buyer may agree a plan for missing measures. The NCSC describes working with a supplier while it fixes shortfalls. Discuss whether the gaps can be closed in the time available.
Put the proposed work in a plan. Record which measures are met, which are missing, the actions, the timescales and the review dates. Keep the buyer’s decision about accepting the gaps separate from the plan itself.
Where to look in the NCSC guidance: planning for gaps, followed by contract terms.
The first visible section explains that a buyer may choose to work with a supplier while it fixes shortfalls. It says continued assessments help keep the picture up to date. The next visible step covers contract clauses. Neither passage says a supplier can decide for itself that a buyer’s requirements no longer apply. Open the source to read the full guidance.
National Cyber Security Centre. Crown copyright. Contains public sector information licensed under the Open Government Licence v3.0. Captured 8 October 2026. View full size · Image licence
What should you keep for the next request?
Keep the answers and their evidence up to date. Before reusing a reply, check that it still describes the service being offered. The NCSC treats the evidence as a picture at a particular time, not a permanent result.
This means you will need to consider how to keep the responses (and any evidence) up to date.
What to do
- Ask whether certification is required for the contract.
- Describe the current measures, evidence and gaps clearly.
- Discuss a plan with the buyer where requirements are not met.
- Keep the evidence current for later reviews.
Common questions
Will a buyer accept us without certification?
That depends on the buyer’s requirements. The NCSC allows for a buyer choosing to work with a supplier while gaps are fixed. It does not promise acceptance.
Can we say a planned measure is already in place?
The reply should distinguish measures that are met from those still missing. Describe the plan as future work and discuss its timescale with the buyer.
Do we need every document before asking for clarification?
Start the conversation when requirements are unclear. The NCSC says suppliers should ask customers to explain their security needs and confirm that proposed measures are acceptable.
Where next
Sources
- NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach, checked 8 October 2026
- NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control, checked 8 October 2026
- NCSC, Supplier assurance questions, checked 8 October 2026
- NCSC, Supplier assurance: having confidence in your suppliers, checked 8 October 2026
- NCSC, Terms & conditions, checked 8 October 2026
- nationalarchives.gov.uk, Open Government Licence, checked 8 October 2026
This is an independent editorial guide, not legal advice.