The Assurance Desk
Part of the guide Customer security questionnaires: what they ask and how to answer
How much checking does a supplier need?
Start with what the supplier will do for you. How much would it matter if that service failed or the supplier caused a security problem? Use that answer to set realistic security requirements.
This guide follows UK National Cyber Security Centre guidance, known as the NCSC. Its questions are a starting point for a conversation. The NCSC recommends that IT works with the business, buying team and security team.
From business risk to useful evidence
- Understand the risk What could go wrong with this supplier’s service?
- Set the requirements Choose security measures that match that risk.
- Check the evidence Look for support for the supplier’s answers.
- Keep the conversation open Review changes during the contract.
What do buyers check?
A useful review asks who does the work, what protects the service and what would happen if things went wrong. The table gives questions to adapt to the service you are buying.
| Area | Question to ask | Evidence to discuss |
|---|---|---|
| Responsibility | Who owns cyber security here? | The people responsible and their roles. |
| Access | Who can reach the data and systems? | How staff access is limited to what their work needs. |
| Recovery | How would the service keep going after an incident? | The recovery plan and the service level it supports. |
| Testing | What has been tested, and what was fixed? | Independent test findings and the response to them. |
| Certification | Does the certificate cover this service? | Its scope, meaning the work and systems it covers. |
| Leaving | What happens to the data when the contract ends? | Terms for returning or securely deleting it. |
Is a certificate enough?
Check the scope before relying on a certificate. It needs to cover the part of the service you will use and the way you will use it. Then check the evidence for your other security requirements too.
Put the agreed security requirements into the contract. The NCSC also says these requirements should reach any subcontractors involved.
A box ticking approach often leads to a false sense of cyber security.
What happens after the contract is signed?
Keep talking to the supplier about changes. Regular reviews can cover security incidents and how the supplier manages accounts that can reach your systems or information.
A monitoring tool can flag a change worth discussing. Treat that as a reason to ask questions. The NCSC cautions that such tools may not give a precise test of what a supplier can do.
Check the exit arrangements before you need them. The contract should explain how your data will be returned or deleted when the work ends or moves to another supplier.
What to do
- Define the risks attached to the service before choosing the questions.
- Ask for evidence and check what it actually covers.
- Agree the contract requirements, then keep reviewing changes.
Common questions
Is supplier assurance just a questionnaire?
No. Questions help start the review, but buyers also need evidence and an ongoing conversation. Ticking boxes alone can give false confidence.
Should every supplier face the same checks?
The checks should match the supplier’s importance and the risks to your business. Set requirements that are justified and realistic for that supplier.
Where next
Sources
- NCSC, Supplier assurance: having confidence in your suppliers, checked 8 October 2026
- NCSC, Supply chain security guidance, The principles of supply chain security, II. Establish control, checked 8 October 2026
- NCSC, How to assess and gain confidence in your supply chain cyber security, Stage 3: Apply the approach to new supplier relationships, Step 3: Monitor supplier security performance, checked 8 October 2026
- NCSC, Supplier assurance questions, checked 8 October 2026
This is an independent editorial guide, not legal advice.