Topics

Topics — your customer's cyber questions, answered

What is your situation? Choose the situation that matches your company. Each topic answers one question, with the reference in the regulation included.

General and business

• What is the statutory name of the undertaking?
• Under which registration number is the undertaking registered?
• What is the registered office of the undertaking?
• In which sector is the undertaking active?
• How many employees does the undertaking have?
• What is the annual turnover of the undertaking?
• In which countries does the undertaking have establishments?
• Does the undertaking have a business liability insurance?
• Is the undertaking ISO 9001-certified?
• Does the undertaking have a plan to continue operations in case of serious disruption?
• Do the online services of the undertaking comply with accessibility requirements?
• Does the undertaking use AI systems in its service delivery?
• Is a digital product passport available for the supplied products?
• why does one customer have something different than another when the question is the same
• who is allowed to approve the answers here before they are sent
• customer sends questionnaire in English or German, does that work too
• the system does not understand a question from the list, what happens then
• I clicked yes but the answer was not correct, can I fix that
• do I have to upload it myself at my customer or does the system do that
• I have five questionnaires in, can I get them all done at once
• there is a question for which no answer has been recorded at all, what now
• how often do I need to update my data and answers to stay current
• does my customer get his own format back or does the layout change
• can I process multiple questionnaires at once
• what file format must my questionnaire have to upload
• can I fill in the answer differently than in my file
• who in our company must approve the answers before we submit
• do I have to submit the completed list myself to my customer's portal
• does supplia log in to our customer's portal to fill in something
• Does anyone at supplia read our completed questionnaire
• Does supplia award a certification or score to our answers
• Who is responsible if an answer in the file is incorrect
• We are receiving a questionnaire from a new customer for the first time, what should we do
• How does the system know this is the same question as with another customer
• We have already submitted but the answer has since changed, what now
• Can multiple colleagues update the supply chain file simultaneously
• Our customer sends a questionnaire in English or German, does that work
• The customer asks to upload a certificate or attachment, is that possible
• There is no answer yet in our file for this question, what happens then
• How quickly is a questionnaire processed after uploading
• Can the answer be automatically reformulated differently per customer
• Do all our locations have one shared file or each their own
• Our customer has amended the questionnaire, do we need to start over
• Can I look up the answers we gave to this customer last year
• The system links the wrong answer to a question, how do I correct that
• What does supplia actually not do, where does your role end
• Can one customer see which answers we gave to another customer
• How does the system know which answer matches which question
• What if the questionnaire asks something that is not in our file
• Do I need to review each answer before I submit it
• Who must upload the questionnaire from our customer
• Two customers ask almost the same thing but worded slightly differently
• Can I temporarily adjust an answer for this one customer
• The customer portal does not accept the exported file
• Does it also work if the questionnaire is a PDF or Excel
• Who ultimately submits the answer to the portal
• What should I do if an answer in the file is outdated
• Who within our company may amend the file
• How much time does this system actually save with questionnaires
• Can I see what we filled in last time
• The question does not entirely match our standard answer
• How do I give a new employee access to the file
• Are old completed questionnaires kept or deleted
• Customer wants a signature or declaration with the answer
• Can different locations have different answers
• What happens if I reject an answer with no
• Must I re-approve each amended answer
• Can the system handle a questionnaire in two languages
• What if there is no answer yet to a question asked
• can I have the questionnaire reviewed by a colleague first
• how often do I need to keep the file up to date
• the customer asked additional questions after submission
• two customers are actually asking the same question but phrased differently what should I fill in
• the answer that was automatically filled in is no longer correct what should I do
• I upload a PDF with questions but the system does not recognize the questions well
• who must approve the answers internally before they are submitted
• what happens if I click no on an answer that the system suggests
• the questionnaire asks about something for which there is no answer in my file at all
• my customer sends a questionnaire in English or German can the system recognize that
• who in our company can view or modify the supply chain file
• can two colleagues fill in or confirm the same questionnaire at the same time
• the questionnaire contains a question that does not apply to our situation at all what do I fill in
• can I see what we answered last year with this customer on the same questionnaire
• the questionnaire is an Excel file with multiple tabs will that be recognized
• the system has linked the wrong question to the answer from my file how do I correct that
• can I attach a certificate or policy document as an attachment to an answer
• the questionnaire asks for a short explanation next to the answer can that also be automatic
• why do I have to figure everything out again every year because the questionnaire format is different
• we have multiple subsidiaries do I have to fill in the questionnaire separately for each company
• my customer does not have a portal and wants the completed questionnaire back by email
• can I have three questionnaires from different customers filled in at once
• do I get the questionnaire back in the same Excel or PDF format as I uploaded it
• can I manually change an answer that was automatically filled in
• I click no on an answer what should I do then
• who ultimately submits the completed questionnaire to my customer's portal
• does supplia itself log in to my customer's purchasing portal
• does an employee of supplia read the questionnaire I have uploaded
• how do I update the supply chain file if something changes in my company
• a question is not included in the file can I add it myself
• can multiple employees from my company log in to the same account
• do I get a certificate or seal from supplia for my answers
• who checks the answers before they go to my customer
• can I also upload a questionnaire in English or German
• can I see an overview of all questionnaires I have completed this year
• two customers are asking the same question worded slightly differently what does the system do then
• can I upload a scanned PDF questionnaire or does it have to be a Word file
• a question has a follow-up question if you select yes how does that work
• can I export a separate file with all my standard answers
• does a director have to approve the questionnaire before it is submitted
• my customer uses a portal that is not yet known, can it be added
• my customer has modified the questionnaire, do I have to do everything again
• my file is not yet complete, can I still have a questionnaire filled in
• who is responsible if a completed answer later turns out to be incorrect
• each customer requests their own format, can this system handle that
• how do I upload the questionnaire I received from my customer
• the system does not recognize a question from the list, what should I do
• is the completed list automatically submitted to my customer's portal
• do I have to give you my login details for the customer portal
• how do I ensure that the chain file contains current information
• can multiple colleagues fill in the chain file together
• what happens if there is no answer in the file yet for a question
• do you verify or certify whether my answers are correct
• does someone from the platform review the questionnaire I upload
• can I process questionnaires from multiple customers side by side
• where can I find the questionnaire I submitted last year
• my customer sends the questionnaire in English, does that work too
• can I also upload a PDF or Excel file from my customer
• the procurement department of my customer sends a different list than sustainability, does that belong here too
• may I give a more detailed answer for one than for the other
• how long does it take before an uploaded questionnaire is filled in
• can I see afterwards who confirmed a particular answer
• my customer modified the questionnaire after I had already started, what now
• how do I add a new colleague who is also allowed to process questionnaires
• may our external advisor fill in the questionnaires on our behalf
• how can I have our chain file and account deleted
• how does this system work exactly, what happens when I upload a list
• can I still modify the completed answer before I submit it
• who must confirm the answers with us before submission
• do I have to submit the list myself or do you do that for me
• what is that single chain file that everything is filled in from
• why do I have to keep filling in the same questions for different customers
• I click no for an answer, what happens to that question
• do you log in yourselves to my customer's portal
• who is responsible if an incorrect answer is submitted
• do you also issue a certificate or score about our company
• how do I keep the data in my file up to date
• who can access our data in the file
• the list asks for something for which there is no answer in my file
• can a colleague or advisor do this on my behalf
• my customer is now using a different form than last year, what should I do
• can multiple locations of our company use the same file
• how are answers to a questionnaire filled in automatically
• can I upload the questionnaire from my customer's portal here
• who is responsible for filling in the security questionnaire
• may I give a different answer to one than to another on the same question
• what if I accidentally give a wrong answer in my customer's questionnaire
• customer asks for supporting documents for each answer in the questionnaire what do I send
• my customer's questionnaire is completely unsuitable for a small business like ours what now
• I keep filling in the same answers for different customers how can I do this faster
• who is responsible for filling in customer questionnaires about security
• customer asks for supporting documents for the answers to the questionnaire
• I gave a wrong answer to my customer's questionnaire what now
• customer asks for the signature of the management on the questionnaire

ESG — environment

• customer asks about scope 1 2 and 3 emissions, how do I fill that in correctly
• questionnaire wants energy consumption per location, we only have a total
• customer wants to know how we separate and reduce waste, what do I fill in
• the questionnaire asks for scope 1 2 and 3 emissions but that is not in my file

ESG — social

• questionnaire asks about diversity in our workforce, how do I approach this
• how do I answer questions about working conditions further in my supply chain
• customer wants to see our supplier code of conduct, do we need one
• the questionnaire asks about working conditions with our own suppliers

ESG — governance

• questionnaire wants to know who is on our board and how it is composed
• customer asks if we have a reporting procedure for misconduct, how do I fill that in
• questionnaire asks about our anti-bribery policy, what is a good answer
• the questionnaire asks if we have a whistleblower scheme what do I fill in

Cyber and NIS2

• Does the enterprise have a policy for risk analysis and the protection of information systems?
• Is there a procedure for handling security incidents?
• Are there back-ups and contingency measures to restore service delivery?
• Does the enterprise impose security requirements on its own suppliers?
• Is there a process for identifying and remediating vulnerabilities?
• Is the effectiveness of security measures periodically assessed?
• Do employees receive training in basic cyberhygiene practices?
• Is there a policy on the use of cryptography and encryption?
• Is access policy documented, including the management of business assets?
• Is multi-factor authentication used for access to business systems?
• Is the enterprise ISO 27001-certified?
• Does the enterprise itself fall under the NIS2 Directive or its national transposition?
• Are events in the systems recorded and retained?
• customer asks how we respond to a cyberincident, how do I fill that in
• questionnaire wants to know how we regulate access to systems, what do I answer
• how do I answer the question about our notification procedure in case of a data breach
• customer asks for results of our latest pentest, do we need to provide them
• my customer sends an extensive nis2 questionnaire while that wasn't the case before what should I do with it
• our customer wants to know if we fall under NIS2, what do I fill in
• our insurer wants to fill in a cybersecurity questionnaire for the policy
• customer asks if we use antivirus or endpoint protection
• questionnaire asks what our password policy looks like
• what do I fill in regarding network segmentation
• do we need to inform our customer if there has been a data breach
• questionnaire asks if we have conducted a penetration test
• how do I fill in the question about security when working from home
• questionnaire asks about the security of our cloud provider
• what do I enter for the question about data classification
• questionnaire asks whether we screen employees before hiring
• how do I fill in the question about physical security of our data center
• questionnaire asks how we respond to a ransomware attack
• how do I enter that we revoke access of departing staff
• questionnaire asks how we manage risks from our suppliers
• questionnaire asks who within management is responsible for cybersecurity
• how do I enter that employees can report a security incident
• questionnaire asks about our patch policy for software updates
• what do I enter for the question about encryption of data at rest and in transit
• questionnaire asks whether our company has taken out cyber insurance
• we don't have an ISO certificate, how do I answer that question well
• our customer is subject to NIS2 and now sets requirements for us, what does that mean
• how do I fill in the question about data minimization for personal data
• questionnaire asks about our recovery time after a cyber incident
• how do I fill in the question about VPN and secure remote access
• my insurer wants a cybersecurity questionnaire, how do I fill that in
• customer asks if we have had a pentest performed, what should I answer
• we don't have a CISO, who do I enter as responsible for security
• customer asks if we perform phishing tests with employees, what if we don't
• questionnaire asks about our password policy, must it be documented in writing
• customer asks how we secure remote work, what do I enter there
• questionnaire asks whether laptops are encrypted, how do I know for sure
• must we report a security incident from last year to our customer
• customer wants to know how our cloud provider is secured, what do I enter there
• we are not ISO 27001 certified, what do I write in the questionnaire
• questionnaire asks whether employees work via VPN, how do I substantiate that
• customer asks which antivirus or endpoint protection we use
• questionnaire asks whether our network is segmented, what does that mean
• customer asks whether we revoke access of former employees immediately, how do I prove that
• questionnaire asks about financial impact of previous cyber incidents, what do I enter
• customer asks which suppliers have access to our systems
• questionnaire asks whether our website uses SSL or TLS, how do I check that
• customer asks about our mobile device policy, what do I enter there
• we must demonstrate that we check our suppliers for cybersecurity, how do I do that
• questionnaire asks whether we have reported incidents to a supervisory authority
• customer asks about our recovery time after a system outage, what do I enter there
• customer asks how our office wifi is secured, what do I write there
• questionnaire asks for security contact person, who should that be at our company
• the customer asks how we classify sensitive information, what is our answer
• questionnaire asks how quickly we install patches, what do I enter
• each customer sends their own cyber questionnaire, how do I approach this cleverly
• my cyber insurer sends an extensive questionnaire, what must I fill in
• I don't understand a technical question from the questionnaire, who can answer this
• my customer asks for supporting documents with the questionnaire, what must I provide
• is filling in this questionnaire the same as complying with NIS2
• my client falls under NIS2 and I don't, what does that mean for me
• we don't have an IT department, who should fill in this security questionnaire
• I don't know the answer to a question, can I enter no
• the questionnaire asks whether we have had a penetration test carried out
• the questionnaire asks whether we have a SOC or SIEM, what does that mean
• the questionnaire asks whether we have had a cyber incident in recent years
• how do I describe our password policy in the customer's security questionnaire
• the questionnaire asks how we secure working from home and remote access
• the questionnaire asks about our policy for mobile devices and laptops
• the questionnaire asks how we monitor the cyber security of our own suppliers
• the questionnaire asks where and how we store the customer's data
• the questionnaire asks whether data is encrypted when transmitted and stored
• we are not ISO 27001 certified but we do a lot for security, what do I enter
• the questionnaire asks whether we have a crisis plan for a cyber incident
• the questionnaire asks who within our company is responsible for cybersecurity
• I keep receiving almost the same questionnaire from different customers, should this be faster
• the questionnaire asks how we revoke access when an employee leaves
• the questionnaire asks whether we use a firewall and antivirus, how do I answer that
• filling in this security questionnaire takes me far too much time every time
• the questionnaire asks how long we retain our system logs and log files
• my insurer wants to see a pentest report, what must I provide
• customer wants to know if I report incidents within 24 hours
• they ask who our CISO is but we don't have anyone with that title
• customer asks whether we carry out phishing tests on employees
• they want to know what our password policy looks like
• how do I show that all our laptops are secured
• they want to know how we secure working from home
• they ask in which country our data is stored
• questionnaire asks whether we classify data according to sensitivity
• they ask who has access to their data
• must I report a data breach to the customer whose data it concerns
• customer wants to know how often we have our systems tested
• we are not certified but the questionnaire asks for it anyway
• they ask if our business network is segmented into divisions
• customer asks how we secure employee mobile devices
• should we ask the same cybersecurity questions to our own suppliers
• customer asks if we are insured against cyber damage
• they ask if our employees log in with a single login to everything
• they ask for our complete security policy as a document
• they ask how our office wifi network is secured
• questionnaire asks about risks in our supply chain, what does that mean
• do I need to send our response plan as a document to the customer
• my customer asks if we fall under NIS2 what should I fill in
• insurer asks security questionnaire for cyber insurance what should I do
• each customer has a different security questionnaire do I have to start over each time
• customer asks about our password policy what should I answer
• do I need to report a security incident from last year in the questionnaire
• customer asks for pentest results but we have never done a pentest
• customer asks about security of our cloud provider what should I answer
• questionnaire asks which antivirus or endpoint protection we use
• customer asks how we revoke access from employees who have left
• customer wants us to sign a statement about security is that allowed
• customer asks who our CISO is but we don't have a separate role for that
• questionnaire asks if we conduct phishing tests with our staff
• customer asks how we arrange access for external suppliers or freelancers
• questionnaire asks about policy for mobile devices and laptops of employees
• customer asks how we are protected against attacks via our suppliers
• questionnaire asks if our data is encrypted at rest how do I know that
• customer asks how quickly we would notify them of a data breach
• we don't have a formal security policy can I still answer yes to the questionnaire
• insurer wants to fill in questionnaire for cyber insurance how do I tackle that
• each customer sends a different questionnaire how do I keep track of this
• customer asks if we have had a penetration test carried out what do I say
• customer asks about our password policy what should be in it
• questionnaire asks if home work stations are secured what do I answer
• do I need to report a hack or data breach to my client
• questionnaire asks if accounts of departed employees are blocked
• customer wants to know if our cloud service is sufficiently secured what do I answer
• questionnaire asks about network segmentation what does that mean and what do I fill in
• questionnaire asks if we conduct phishing tests among staff
• questionnaire asks how we monitor the security of our suppliers
• questionnaire asks about physical security of server room or data center
• questionnaire asks if management is involved in cybersecurity
• questionnaire asks whether the business continuity plan has been tested what answer should I provide
• questionnaire asks about data classification what should I fill in
• questionnaire asks about antivirus software or endpoint protection what should I say
• questionnaire asks how quickly we implement security updates
• my customer asks whether I fall under NIS2 what should I answer
• our insurer wants to fill in a cybersecurity questionnaire for the policy
• questionnaire asks about our password policy how should I answer that
• questionnaire wants to know which antivirus or endpoint protection we use
• customer asks whether our data is encrypted during storage and transmission
• customer asks how we secure remote work and BYOD what should I enter
• questionnaire asks about firewall and network segmentation how should I answer
• questionnaire asks how we would report a data breach to them
• customer asks how we manage access of external suppliers
• customer asks whether we have recently had a penetration test carried out
• questionnaire asks whether we are insured against cyber incidents
• questionnaire wants to know which cloud services we use for our data
• questionnaire asks whether we have drawn up an incident response plan
• customer wants to know whether we carry out phishing simulations with employees
• questionnaire asks how quickly we implement updates and patches
• customer asks about the physical security of our server room
• questionnaire asks whether we have a business continuity plan
• customer wants to know who is responsible for cybersecurity at our company
• questionnaire asks how we map risks in our supply chain
• questionnaire wants to know whether we classify data according to sensitivity

Financial and KYB

• bank asks for the ultimate beneficial owners of our company how should I fill that in
• insurer asks about our financial health what should I enter
• why does the bank ask completely different questions than the insurer when it is about the same thing
• in the questionnaire there is a request for the UBO where is that answer in my file
• how does payment work do I pay per completed questionnaire or a fixed amount per year