For Cybersecurity Awareness Month, I want to show what security awareness looks like at my desk. Not in a training module, but where supplier assessments land.
As Deputy CISO at KuppingerCole Analysts, I have a supplier questionnaire that I know by heart. Sixty questions in seven blocks: physical access, logical access, authorization, data segregation, transfer control, availability, compliance. Every new software vendor and every new partner gets it.
Last quarter we assessed a tool from a supplier without any certification. They filled in all sixty questions, after which came the follow-ups, because a “yes” in a spreadsheet tells me very little on its own, and then the maturity rating for each answer. The whole exercise took several days, and when I look back, most of that time went into chasing answers to questions that an audit would already have covered if the supplier had been certified. With a certified supplier, the same assessment usually takes a fraction of that time.
I have seen this pattern often enough now to trust it: a valid ISO/IEC 27001 certificate changes which questions I still need to ask, even though it does not by itself make a vendor secure.
What I No Longer Ask
Before anything else, I check that the certificate is real and current: issued by an accredited certification body (IAF CertSearch or, in Germany, DAkkS will confirm this), still valid, backed by a recent surveillance audit, and issued against ISO/IEC 27001:2022. Certificates against the 2013 version have not been valid since 31 October 2025.
If the certificate holds up, the scope covers the service we are buying and the Statement of Applicability (SoA) is available, I can leave out most of the questionnaire, provided the SoA does not exclude these controls:
- whether access to offices and server rooms is controlled
- whether everyone logs on with their own account, failed attempts are limited, and patches get applied
- whether admin rights are restricted and laptops are encrypted
- whether backups exist and someone has written an emergency plan
- whether employees are trained and bound by confidentiality
An accredited auditor has already examined these areas on a sample basis, with evidence, and in more depth than a “yes” in my spreadsheet ever could.
What I Still Ask
These I ask with or without a certificate:
- Which of our data goes to the supplier, and where exactly does it live?
- Is our data processed separately from other customers’ data?
- Which subcontractors process our data, and where?
- What does the data processing agreement say, and who signs it?
- When something goes wrong, who calls whom, and how fast?
These questions are about us, not about how mature the supplier is in general, so no audit can answer them for me. The certificate takes the generic part off my desk, while the part that only we can judge stays with me. Regulation points the same way: the NIS2 Directive (Art. 21(2)(d)) requires entities to address security in their relationships with each direct supplier, and the Digital Operational Resilience Act (DORA, Art. 28 to 30) expects financial entities to keep a register of their ICT third-party arrangements and to put specific clauses into those contracts. None of that can be ticked off with a supplier’s certificate.
Where the Certificate Stops
A certificate is a series of sampled snapshots. Each audit happens in a particular week, and what matters is how the controls are run in the week after the auditor has left. This is where awareness comes in, because establishing that a control exists is the easy part, and what I want to know is whether the person running it understands why it is there.
And awareness is not only the supplier’s job. On our side, the biggest gap is the company credit card: a team needs a tool, someone pays for it, and nobody in security knows it exists until it is already in use. When the assessment does happen, it often arrives as the last hurdle before go-live: “We have everything in place, could you just quickly sign this off?” On the supplier’s side, I can usually tell within the first few answers whether awareness is real. The partners who worry me are those who never ask and fill in the spreadsheet as fast as they can, whereas those who ask why we need sixty answers usually reassure me, because a good question back tells me more than a quick “yes”.
Not every label works the way ISO/IEC 27001 does. We went through the Trusted Information Security Assessment Exchange (TISAX) ourselves, at Assessment Level 3 with an on-site audit, and in our experience, it answers a different question. A TISAX label is valid for three years without any surveillance audit in between, which makes it a single photograph rather than a series of snapshots. At Level 2, it is a plausibility check of the supplier’s self-assessment, usually done remotely. It was built for the automotive supply chain and is rarely asked for outside it. The results are shared through the ENX portal rather than published, and anyone who already holds ISO/IEC 27001 will find that much of the ground is covered a second time.
My questionnaire also has no section on AI yet. When it gets one, will I ask for ISO/IEC 42001? The standard is young, few suppliers are certified against it, and the scope questions start all over again, which is a question that deserves a post of its own.
What I Take from This
- If you are the one assessing: look at the scope and the Statement of Applicability first, then put your time into the questions nobody else can answer for you.
- If you are the one being assessed: your certificate saves your customers days of work. Make it easy to find and make the scope visible.
- Either way, the real goal on both sides is a reason to trust each other rather than a completed questionnaire, and a certificate is the quickest starting point I know.
If this sounds familiar, write to me or to Christopher Schütze. I would like to hear how you handle it.
