Your customers want proof of your security
Banks, insurers, hospitals and larger firms have to check the software and services they rely on. The questionnaire, the contract clause and the tender question land on you, even where no law names you.
Where the questions come from
- NIS2: a regulated customer must secure its supply chain (Article 21(2)(d)) and weigh each direct supplier's security practices (Article 21(3)).
- DORA: a bank, insurer or payment firm must put set terms into its contracts with technology providers (Article 30), and keep a register of them.
- The GDPR: where you process personal data for a customer, it must have a contract with you that meets Article 28.
- Tenders and enterprise procurement: ISO 27001, a SOC 2 report or a filled-in questionnaire as the price of entry.
Answer once, keep it true
Each customer asks in its own words, but the ground is the same: access and two-step sign-in, backups and a tested restore, incident notice, personal data, and certification. Answers kept with their evidence can be reused for the next questionnaire, and checked again before each one goes out. The questionnaire page sets out each group and where it comes from.
When a certificate is the question
The one to get is the one your customer asks for: a SOC 2 report from a licensed CPA, or an ISO 27001 certificate from an accredited certification body. We prepare you for ISO 27001, starting with the Statement of Applicability.
What we do
Protect, from €3,450 up to 10 staff
We put the basics customers ask about in place across your Microsoft 365 or Google Workspace, email and website, and prove each one with a second scan or a dated document. You get an evidence pack to attach to the questionnaire.
Read first
- Free toolSupplier security questionnaire checkWhich answers you can prove, where each question comes from, and the fix.
- A customer sent you a security questionnaire
- NIS2 for suppliers: the questions your customer will ask
- SOC 2 vs ISO 27001
- Does the Cyber Resilience Act cover SaaS?
- What ISO 27001 costs in Ireland
Start here
The free compliance check looks at your website and email from outside while you answer a few questions, and keeps the result as your compliance record. Or tell us what you have been asked, and we tell you what to do first.