# How do you answer a security questionnaire without a certificate?

Show what is in place, explain any gaps and find out what the buyer needs before making promises.

The Assurance Desk. Published 8 October 2026. Last checked 8 October 2026.

Part of the guide [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md).

**The short answer.** Say that you are not certified, explain the security measures you have and offer evidence. Ask whether the buyer requires that certificate or can consider another way to check your security. A buyer may agree to work with gaps, but that is their decision ([NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach), [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control) and [NCSC, Supplier assurance questions](https://www.ncsc.gov.uk/guidance/supplier-assurance-questions), checked 8 October 2026).

## Is the certificate a firm requirement?

Start by asking which certificate the buyer wants and whether it is a condition of the contract. Do not treat a request for certification as the same question as whether you have security measures in place ([NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach) and [NCSC, Supplier assurance questions](https://www.ncsc.gov.uk/guidance/supplier-assurance-questions), checked 8 October 2026).

If the requirement is unclear, ask the buyer to explain it. The UK National Cyber Security Centre is known as the NCSC. Its guidance says suppliers should check that customers accept the measures being taken ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

You still need to meet the requirements that apply to your work. A plan to improve is something to discuss with the buyer, not permission to ignore those requirements ([NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

## How should you describe a gap?

Describe a gap by separating a missing document from a missing security measure. If you cannot show that a measure works, say what still needs checking. If it is not in place, explain what can be done ([NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

**Illustrative replies to adapt after checking the facts**

| Your position | What the reply should explain |
| --- | --- |
| The measure is in place | Describe what it covers and the evidence available. |
| Evidence is still being checked | Explain what is unconfirmed and when an update can be given. |
| The measure is not in place | Describe the gap and discuss an achievable improvement plan. |
| The question does not seem to fit | Explain why and ask the buyer to confirm what is required. |

Source: NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach, https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach (checked 8 October 2026); NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control, https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control (checked 8 October 2026)

## What evidence can you offer?

Useful evidence includes the security policies that apply to the service and how you check that people follow them. If independent security tests have been done, discuss the findings and what was fixed ([NCSC, Supplier assurance questions](https://www.ncsc.gov.uk/guidance/supplier-assurance-questions), checked 8 October 2026).

Ask which evidence the buyer needs. The depth of the review should reflect how important your service is to them and the risks it brings. A folder of unrelated documents does not answer that question ([NCSC, Supplier assurance: having confidence in your suppliers](https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers), checked 8 October 2026).

**Build a reply the buyer can assess**

1. Confirm the question: Ask what the buyer needs to establish.
2. Describe the current position: Explain the policy or security measure that applies.
3. Offer relevant evidence: Discuss checks, test findings and fixes.
4. Confirm what remains: Ask whether the buyer needs anything else.

Use this sequence for the security measures being asked about. Confirm the buyer’s requirements before treating the reply as complete.

Source: NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control, https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control (checked 8 October 2026); NCSC, Supplier assurance questions, https://www.ncsc.gov.uk/guidance/supplier-assurance-questions (checked 8 October 2026); NCSC, Supplier assurance: having confidence in your suppliers, https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers (checked 8 October 2026)

## Can you agree a plan for missing measures?

A buyer may agree a plan for missing measures. The NCSC describes working with a supplier while it fixes shortfalls. Discuss whether the gaps can be closed in the time available ([NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach), checked 8 October 2026).

Put the proposed work in a plan. Record which measures are met, which are missing, the actions, the timescales and the review dates. Keep the buyer’s decision about accepting the gaps separate from the plan itself ([NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach), checked 8 October 2026).

**Where to look in the NCSC guidance: planning for gaps, followed by contract terms.**

![NCSC guidance showing where to plan for supplier security gaps and set contract terms.](https://theassurancedesk.com/images/editorial/ncsc-plan-for-gaps.jpg)

The first visible section explains that a buyer may choose to work with a supplier while it fixes shortfalls. It says continued assessments help keep the picture up to date. The next visible step covers contract clauses. Neither passage says a supplier can decide for itself that a buyer’s requirements no longer apply. Open the source to read the full guidance.

National Cyber Security Centre. Crown copyright. Contains public sector information licensed under the Open Government Licence v3.0. Captured 8 October 2026.
Licence: https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/
Source: NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach, https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach (checked 8 October 2026); NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control, https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control (checked 8 October 2026); NCSC, Terms & conditions, https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions (checked 8 October 2026); nationalarchives.gov.uk, Open Government Licence, https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/ (checked 8 October 2026)

## What should you keep for the next request?

Keep the answers and their evidence up to date. Before reusing a reply, check that it still describes the service being offered. The NCSC treats the evidence as a picture at a particular time, not a permanent result ([NCSC, Supplier assurance: having confidence in your suppliers](https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers), checked 8 October 2026).

> "This means you will need to consider how to keep the responses (and any evidence) up to date."
> NCSC, Supplier assurance guidance
> NCSC, Supplier assurance: having confidence in your suppliers, https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers (checked 8 October 2026)

## What to do

1. Ask whether certification is required for the contract ([NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach), [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control) and [NCSC, Supplier assurance questions](https://www.ncsc.gov.uk/guidance/supplier-assurance-questions), checked 8 October 2026).
2. Describe the current measures, evidence and gaps clearly ([NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach), [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control) and [NCSC, Supplier assurance questions](https://www.ncsc.gov.uk/guidance/supplier-assurance-questions), checked 8 October 2026).
3. Discuss a plan with the buyer where requirements are not met ([NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach), checked 8 October 2026).
4. Keep the evidence current for later reviews ([NCSC, Supplier assurance: having confidence in your suppliers](https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers), checked 8 October 2026).

## Common questions

### Will a buyer accept us without certification?

That depends on the buyer’s requirements. The NCSC allows for a buyer choosing to work with a supplier while gaps are fixed. It does not promise acceptance ([NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

### Can we say a planned measure is already in place?

The reply should distinguish measures that are met from those still missing. Describe the plan as future work and discuss its timescale with the buyer ([NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach](https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach) and [NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

### Do we need every document before asking for clarification?

Start the conversation when requirements are unclear. The NCSC says suppliers should ask customers to explain their security needs and confirm that proposed measures are acceptable ([NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control), checked 8 October 2026).

## Where next

- [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md)
- [How much is Cyber Essentials, and what does it ask?](https://theassurancedesk.com/guides/cyber-essentials-cost-and-requirements.md)
- [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md)
- [What is supplier assurance, and what do buyers check?](https://theassurancedesk.com/guides/supplier-assurance-what-buyers-check.md)

## Sources

- NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 2: Develop an approach to assess supply chain cyber security, Stage 2b: Create key components for your approach: https://www.ncsc.gov.uk/collection/assess-supply-chain-cyber-security/stage-2-develop-an-approach/stage-2b-create-key-components-for-your-approach (checked 8 October 2026)
- NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control: https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/ii-establish-control (checked 8 October 2026)
- NCSC, Supplier assurance questions: https://www.ncsc.gov.uk/guidance/supplier-assurance-questions (checked 8 October 2026)
- NCSC, Supplier assurance: having confidence in your suppliers: https://www.ncsc.gov.uk/blog-post/supplier-assurance-having-confidence-in-your-suppliers (checked 8 October 2026)
- NCSC, Terms & conditions: https://www.ncsc.gov.uk/section/about-this-website/terms-and-conditions (checked 8 October 2026)
- nationalarchives.gov.uk, Open Government Licence: https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/ (checked 8 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.