Supply Chain Cybersecurity: When Your Customers Check You

Short answer: supply chain cybersecurity cuts both ways. Bigger organisations are now checking the security of the small firms that supply them, because a weak supplier is an easy way in. If you supply a larger business, a council, the NHS or a university, expect a security questionnaire or a request for Cyber Essentials. The firms that win and keep those contracts are the ones who can answer quickly and honestly.

It usually arrives as an attachment from procurement: a spreadsheet of forty questions, or a single line asking for your Cyber Essentials certificate number. It can arrive at renewal time for a contract you’ve held for years. And it often lands on the desk of someone who’s never had to answer one before.

Questionnaire on your desk right now? Ring 0151 452 3060 and a person picks up. We’ll help you work out what’s being asked and what you can honestly say.

Why your customers are checking you

Attackers go where the defences are weakest. A large organisation might have a security team and strict controls, but its suppliers often don’t, and suppliers are connected: they send invoices, share files, log into portals and sometimes have access to systems. Compromise the small supplier and you can send a convincing email from a trusted address, or reach data through a shared system.

That’s why procurement teams now treat supplier security as part of due diligence. It’s also why central government requires Cyber Essentials for contracts that handle certain personal information and ICT services, and why many other buyers have followed.

What a supplier security questionnaire asks

The wording varies, but the questions come from the same few areas:

• Certification: do you hold Cyber Essentials, Cyber Essentials Plus or ISO 27001?
• Access: is multi-factor sign-in enforced, and how do you control who can reach our data?
• Devices: are they patched, protected from malware and encrypted?
• Data: where is it stored, how is it backed up, and how is it deleted?
• People: do staff get security training, and do you vet people who handle our data?
• Incidents: do you have a plan, and how quickly would you tell us about a breach?
• Your own suppliers: who else can reach our data through you?

That last one surprises people. Your customer wants to know about your IT provider, your cloud software and your subcontractors, because they’re part of the chain too. Our guide to checking your own suppliers gives you the answers.

How to answer without overclaiming

The worst answer on a supplier questionnaire isn’t “no”. It’s “yes” when the honest answer is “mostly”. If a client finds out after an incident that your answers weren’t accurate, the contract is the least of your problems. So answer as things are today. Where there’s a gap, say what you’re doing about it and when it’ll be done. Procurement teams deal with gaps all the time. They deal badly with surprises.

Keep a copy of every questionnaire you answer. Most ask the same things, and the second one takes a fraction of the time.

Want the answers to be yes? We run IT support to Cyber Essentials standards, so the controls are in place and written down before the questionnaire arrives. See managed cyber security or ring 0151 452 3060.

Cyber Essentials: the shortcut most buyers accept

If you keep getting asked, Cyber Essentials is usually the quickest way to answer twenty questions at once. It’s the UK government-backed scheme covering five basic controls, and most buyers recognise it. Some will ask for Cyber Essentials Plus, where an assessor tests the controls rather than taking your word for them.

For most small businesses, getting there is a few weeks of fixing gaps and an online assessment. Our guide to getting Cyber Essentials, step by step covers what’s involved, including the parts people don’t expect: personal phones that get business email, and every cloud service you use.

Turn it into an advantage

If you can answer quickly, with a certificate number and a short document describing your controls, you look like the lower-risk choice. For some contracts, that’s the difference between shortlisted and not. DSIT’s 2025 survey found 43% of UK businesses reported a breach or attack in the previous year, and the buyers checking you know that number too.

For the real-world cases behind all this, see real supply chain attacks, and the lessons for small firms.

Got a deadline from a client? Ring Eric this week with the questionnaire or the requirement, and you’ll know what it’ll take to answer it properly. Ring 0151 452 3060 and a person picks up.