The most common mistake
The most common mistake in a cyber security questionnaire is not filling in something incorrectly, but filling in something you can no longer prove. An answer such as "we make backups" or "password policy has been implemented" is often typed from memory, while the buyer is actually asking about the current situation: is the measure still valid now, and is there a document that confirms it. That difference between what you think you do and what you can prove is at the heart of almost every rejection.
The solution is not in better wording, but in a different order: first get your supporting documents in order, then answer. Those who work the other way round fill in based on memory and risk that the answer no longer matches reality.
Why this goes wrong more often than you think
A cyber security questionnaire rarely comes alone. A bank sends one format, a large customer sends another format, and an insurer asks slightly different questions again — all about roughly the same subjects. Supervisory authorities and industry organisations regularly refer to the ten measures mentioned in the NIS2 Directive, such as access control, incident response and supply chain security. Those who do not take these ten subjects as a fixed starting point answer each list anew from scratch, and that is where inconsistencies arise.
Error 1: the same answer, just worded differently
Because each portal uses its own format, the same fact is often written down slightly differently. In one list you write that access is "limited to authorised staff", in another that a "role model" exists. Both can be true, but if a buyer places the answers side by side — and this happens increasingly often, also automatically — the differences stand out. Not because there is something wrong, but because it looks inconsistent.
Error 2: a measure on paper, not in practice
A policy document drawn up three years ago and never updated is not proof that a measure is still being applied now. Supervisory authorities and buyers do not only look at the existence of a document, but at the date and who approved it. Filling in a questionnaire on the basis of an outdated document is the second most common mistake.
Error 3: expired supporting documents that nobody replaces
Certificates, penetration test reports and insurance certificates have a validity period. Those who do not keep track of these centrally often only discover when filling in a new list that a document has expired. This takes time, and sometimes the entire submission must wait until a new document arrives. read per subject which supporting documents are usually requested and when they typically expire.
Error 4: filling in the scope too widely or too narrowly
A question about "your organisation" is sometimes answered as if it refers to one location, while the buyer means the entire legal entity — or vice versa. This may seem like a detail, but it determines whether the answer is factually correct. If you are in doubt about the scope of a question, it is advisable to check the definition in the questionnaire itself, or to put the question directly to the buyer.
How you prevent this in practice
Most of these mistakes arise because the same information is kept in multiple places separately: in mailboxes, in Excel files, in the head of one employee. One central overview of measures and supporting documents, with a clear last-checked date for each document, prevents most of the above mistakes. This overview does not need to be rebuilt for each list; it is updated as soon as something changes.
Supplia.eu is built to support precisely that overview: the system recognizes the questions in an uploaded list and completes them from your supply chain file, after which you confirm each answer yourself to verify it is correct. We do not assess or explain anything — the content review and submission to your customer's portal remain your responsibility. With a few questions you quickly see where your file currently stands, and on the page about our working method you can find exactly where the information comes from.
What this does not replace
This article describes general patterns, not an assessment of your specific answers or file. Whether a concrete measure meets what a bank, insurer or major customer precisely requires depends on that party's own question set. If you are in doubt about a specific question, it is advisable to put it to the customer, or to consult a lawyer for legal questions. On the FAQ page there is an overview of what we do and do not do.
Would you like to know if your file already prevents the most common mistakes? Do the free quick-scan or browse through the topics in the knowledge base — both are accessible without obligation.