Your customer is assessing you as a supplier. Here is how to prepare.
A vendor assessment is the whole process your customer uses to decide how much risk you bring as a supplier. The questionnaire is only one part. The customer also looks at your documents, sometimes at an external scan of your domain, and puts conditions in the contract. If you know the steps, you can prepare.
Larger customers have to assess their suppliers, for their own policies, for auditors or because of NIS2, DORA or the GDPR. To you it feels like a questionnaire. But more happens, and knowing what comes after the questionnaire prevents surprises.
Vendor assessment or questionnaire: what is the difference?
The questionnaire is what you see. The assessment is what your customer does with it: weighing your answers, checking evidence, deciding on a risk level and on the conditions under which you can become a supplier. A strong questionnaire helps, but the final judgement is what counts.
The steps you may encounter
- Tiering. The customer decides how critical you are: do you process personal data, do you have access to their systems, how bad is it if you go down? That decides how heavy the rest is.
- Questionnaire. Their own spreadsheet, a standard list such as the SIG or CAIQ, or a supplier portal.
- Evidence. Certificates, policies, a penetration test summary, your sub-processor list.
- External scan. Some customers have your domain and public systems scanned, for example for email security and open ports.
- Call. In case of doubt or high risk, a call with their security team.
- Outcome. Approved, approved with conditions, or rejected. Conditions often end up in the contract or in an action plan with dates.
- Reassessment. After a year, after an incident or after a major change.
Where it often goes wrong
- Answers and scan contradict each other. You write that email is well secured, but the scan finds no DMARC.
- Promises that come back in the contract. What you commit to in the questionnaire can end up word for word in the agreement.
- No owner. The action plan after the assessment disappears into an inbox, and at reassessment nothing has been done.
- Starting over for every customer. Without kept answers and evidence, every assessment starts from zero.
How to prepare
- Ask which tier. Ask the customer how they classify you. Then you know how deep the assessment goes.
- Check your outside. Email security (SPF, DKIM, DMARC), certificates on your websites, outdated subdomains. That is what a scan sees first.
- Prepare an evidence folder. Policies, procedures, penetration test, sub-processors, continuity, incident procedure.
- Answer with a source. For every answer, the document or setting that shows it.
- Name open items yourself. With a plan and a date. That prevents the customer from discovering them.
- Keep everything. The next customer will ask almost the same.
How Holdvero helps
We complete the assessment questionnaire based on your own documentation, with a source for every answer and open items where evidence is missing. Up to 150 questions this falls under Questionnaire Rescue (€695). Portals and large assessments fall under the complex questionnaire. If assessments keep coming, we keep answers and evidence current with Evidence Maintenance. Holdvero does not provide certification or legal advice.
Frequently asked questions
What is the difference between a vendor assessment and a security questionnaire?
The questionnaire is one part of the vendor assessment. The assessment is the whole process: tiering, questionnaire, evidence, sometimes a scan or call, an outcome and later a reassessment.
What happens if I do not meet every requirement?
That is normal. You are often approved with conditions: an action plan with dates. What matters is being honest about what is missing and giving a realistic plan.
Can I refuse an external scan?
An external scan usually only looks at what is publicly visible. If a customer goes further, such as a penetration test of your systems, that requires a written agreement.
How often will I be reassessed?
It differs per customer. Often yearly for important suppliers, plus after an incident or a major change in your service.
Need help with a vendor assessment?
Within 1 working day you'll hear the price and when you get it back. You only pay after agreeing the price.
Get a fixed price