Partly: a supplier’s current certifications cover many of the control questions in a supplier security questionnaire, with evidence an independent assessor has verified or tested. Map your questionnaire to those certificates and ask only the questions they leave open. The NCSC’s Supply Chain Playbook suggests buyers could align questionnaires to Cyber Essentials controls and accept a certificate as validation. The MOD instructs its buyers to treat a current Defence Cyber Certification at the level a contract requires as meeting the DEF STAN 05-138 control requirement. This post covers the mapping method and the checks to run on each certificate.
What does a supplier security questionnaire tell you?
A questionnaire records what a supplier says about its security controls on the day it answered. That tells you whether controls exist. It cannot show how much cyber risk the supplier carries today.
Evidence comes when the buyer asks for it. At the supplier, the questionnaire goes to whoever handles customer requests, which can be admin, a sales team, or simply AI. That team may route questions to the control owners, but you receive the answer without knowing who wrote it or what it rests on. Questionnaire-automation vendors are now selling AI that drafts answers from a supplier’s existing documents. At the buyer, a risk or procurement team reads the result, sometimes through its own AI tool, this is increasingly common. In EY’s 2025 global third-party risk survey of 500 executives, 45% said their questionnaires run to 101–200 questions and 36% to 201–350.
How is compliance verification different from a questionnaire?
Compliance verification means answering a supplier assessment from certifications and audit reports that an independent assessor has verified or tested against a published standard. You then ask the supplier only about what those documents do not cover.
| Assessment questionnaire | Compliance verification |
Who reviews it | A risk practitioner, procurement or an AI tool reads the completed answers | A certification body or auditor, approved by an accrediting or licensing body, verifies or tests the evidence |
What is reviewed | Answers, often yes or no, on cyber, ESG and GDPR topics such as access control, data protection and business continuity | Controls, the policies behind them and the evidence the assessor examines |
Who supplies it | Whoever handles the request, such as a bid or sales team, sometimes with an AI tool | The people who run the controls, such as the CISO or the IT team, or the ESG officer for ESG schemes |
ISO 27001 covers a wider set of controls than Cyber Essentials, a technical baseline of five, and a SOC 2 Type 2 report tests how controls operated over a period. EcoVadis rates suppliers on ESG, with ratings its analysts review and verify. Defence Cyber Certification Level 0, an MOD scheme open to any organisation, has three controls under DEF STAN 05-138: Cyber Essentials, UK GDPR compliance and resilient networks and systems.
How do you map a questionnaire to a supplier’s certifications?
Start with the certificates the supplier holds.
- Collect the documents. Ask for certificates and reports in place of answers: Cyber Essentials or Plus, ISO 27001 with its scope statement and Statement of Applicability, a SOC 2 report, or DCC. SOC 2 reports usually come under NDA.
- Check each document. Confirm the issuer, the level, the date, the scope and that the legal entity named is the one you contract with. Treat an ISO 27001 certificate from an unaccredited body as unverified, and check UKAS-accredited ones on UKAS CertCheck.
- Map each question to a control. NIST’s catalogue of CSF 2.0 informative references lists published mappings for ISO/IEC 27001:2022 and the CSA Cloud Controls Matrix.
- Mark each question covered or residual, and record why. A question is covered only when a current, in-scope certificate verifies or tests that control at the level you need.
- Send the residual questions with a request for evidence. The questionnaire you send is shorter, and each answer in it comes with evidence.
If the supplier holds nothing relevant, you still send the full questionnaire, scaled to how critical the supplier is.
Question | Evidence that may exist | Result |
Are critical and high-risk updates applied within 14 days? | Cyber Essentials v3.3 requires this for in-scope software, and Plus tests it | Covered, if the service is in scope |
Is the business continuity plan tested? | Not in Cyber Essentials; in ISO 27001 if the control is in the Statement of Applicability | Partly: ask for the last test result |
Which sub-processors handle our data, and where? | A certificate rarely answers this for your contract | Residual: ask, with evidence |
A qualified assessor should approve any software-drafted mapping, such as one from Black Kite’s Assess module, before it counts as evidence.
Elasticito can assist in the process, mapping your current questionnaires and requirements, against certifications the vendor or client currently holds.
Do regulators accept certifications for third-party due diligence?
Yes, as evidence within your own assessment. For critical or material arrangements, regulators expect you to check each certificate, keep your audit rights and not rely on certificates alone. For a UK bank, the EU texts apply through its EU entities.
Source | What it allows | Conditions |
EBA Guidelines on outsourcing (EU, 2019), paras 91–93, repeated in its September 2026 final report, paras 102–104 | Third-party certifications and audit reports supplied by the provider | Scope covers key controls; content current; competent certifier; recognised standards; operating effectiveness tested; own audit right kept |
Certifications and audit reports for ICT services supporting critical or important functions | Not relied on solely over time; the same tests as the EBA | |
PRA SS2/21, paras 8.7–8.9 | Certificates and independent reports as an offsite audit method | In material outsourcing arrangements, the PRA expects firms to “not assume that their mere existence or provision is sufficient evidence” |
PPN 014 (UK government buyers), February 2025 | Cyber Essentials or Plus, or equivalent controls, for in-scope contracts handling personal or OFFICIAL data | Renewed annually; does “not assure specific products or services” |
What a certificate does not cover
A certificate reflects the controls a supplier could show during one audit window, for the scope assessed. Cyber Essentials is valid for 12 months and ISO 27001 certification for three years with surveillance audits in between, while a SOC 2 Type 2 report covers a period that has already ended. No certificate confirms the supplier is secure today; our post Does compliance make you secure? explains why. Between audits, external monitoring such as Black Kite’s can flag an unpatched known-exploited vulnerability on a supplier’s internet-facing systems before the next certificate is due.
Putting certification requirements in the supplier contract
Name each certification you rely on in the contract, with the scope it must cover, and require the supplier to keep it current and to tell you if it lapses or its scope changes. If a certificate lapses, treat the questions it covered as open again.
Frequently asked questions
Can a SOC 2 report replace a security questionnaire?
A SOC 2 Type 2 report can replace the questions it covers once you have checked it. Confirm that a licensed CPA firm issued it, that the opinion is unqualified and that any exceptions fall outside the controls you rely on. Make sure the scope includes the service you buy and the period is recent. Look for subservice organisations, such as the cloud host, that the report carves out, and for the complementary user entity controls your side must run. A Type 1 report covers design on one date.
How do you check a supplier’s Cyber Essentials certificate?
Search for the supplier on IASME’s certificate search, which the NCSC points to as the list of current certificates. Check the level, the legal entity and the date: certificates last 12 months. Then ask what infrastructure the supplier excluded from scope, because under the April 2026 requirements the public certificate does not list exclusions.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials Plus adds independent technical testing, including vulnerability testing, to the five controls that basic Cyber Essentials covers through a self-assessment verified by a certification body. The controls are firewalls, secure configuration, security update management, user access control and malware protection. Treat a basic certificate as a checked declaration and Plus as tested evidence.
What is supplier assurance?
Supplier assurance is how a buyer gains confidence that a supplier’s security controls are in place and working, before and during the contract. The NCSC’s supplier assurance questions ask whether the scope covers “the parts of the service you will be using”. A questionnaire is one source of assurance, and an in-scope certificate adds an independent assessor’s check.
Conclusion: ask suppliers about the gaps in their certificates
Confirm the service, level and period a certificate covers before you take its control questions off your list.
Our webinar on 18 November 2026 covers the contract terms that keep this in force: Are Your Vendor Contracts Secretly Sabotaging Your Cybersecurity?
Created: 2026-10-06 / Reviewed: 2026-10-19
