A ten-person company receiving a forty-question security questionnaire from a prospective customer is no longer unusual. What was once a review reserved for large IT suppliers is now an ordinary part of selling, in every industry. Supplier security requirements have become part of doing business.
The reason is simple. Regulation, and the liability that comes with it, travels down the supply chain.
Why these requirements keep spreading
Large organisations, public authorities, listed companies, banks and hospitals, are now obliged to manage risk in their supply chains. The GDPR requires them to check their processors. NIS2, implemented in Sweden as the Cybersecurity Act, which we cover in the complete guide, requires them to handle supplier risk systematically. Their own auditors and boards ask about third-party exposure.
The answer to that pressure is questionnaires, forms and sometimes formal security reviews, sent down the chain to you. In the public sector the same demands appear as mandatory requirements in tenders, which we cover in security requirements in public procurement.
What they are asking about
The subjects that come up most often:
The GDPR and personal data: do you keep a record of processing activities? How long do you retain data? Where are your systems located? Who is the controller?
Information security: do you have a security policy? How is access controlled? Do you take backups? How are incidents handled?
Suppliers and sub-processors: which third-party services do you use? Do you have data processing agreements with them? Where do they store data?
Continuity: what happens if your systems go down? How long does recovery take?
Why smaller companies get stuck
The problem is rarely that a company is doing the wrong things. Most have sensible routines. The problem is that the routines are not written down, and that nobody can pull the answers together quickly.
The questionnaire lands with the CEO or a salesperson. Nobody else in the company has the answers. Gathering them takes weeks. The customer waits. The deal slips.
How to answer well
The best thing you can do is to have the answers ready in advance, not for each individual questionnaire, but as one compact summary of where you stand that can be adapted.
Write an internal document covering how you handle personal data, your security policy in brief, which third-party suppliers you use and how they are managed, and your basic incident response process.
That document is the raw material for almost every questionnaire you will get. It takes your response time from weeks to hours.
The strategic point
A company that answers compliance questions quickly and credibly signals maturity. That matters more than it sounds: a buyer who has to justify a choice internally finds it easier to pick the supplier who has their house in order.
Seen that way, compliance is not only risk management. It is a sales argument. We develop the whole case in compliance as a competitive advantage.
Want things in order before the next questionnaire lands? Our Health Check shows where you stand today.
