Supplier cybersecurity questionnaire

Define the scope

Identify the legal entity, service and respondent. An answer about the whole organisation may not describe the product or team providing your service.

• Which service and systems do the answers cover?
• Which of our data is stored or processed, and who can access it?
• Do subcontractors participate in delivery?

Ask about security controls

Request a concrete answer, its scope and appropriate evidence. These are illustrative questions, not a certification or the complete official DTS questionnaire.

• Access: how are permissions approved, reviewed and removed? Is multifactor authentication used?
• Maintenance: who manages updates and identified vulnerabilities?
• Recovery: are backups made and restoration tested?
• Incidents: who coordinates response and informs customers affected by an incident?
• People: what security instructions are given to staff accessing customer information?
• Continuity: what alternatives exist if the service is interrupted?

Record and review answers

For each question record the answer, scope, evidence, date and responsible person. Distinguish implemented, partial, information pending and not applicable, with reasons. An unknown answer is not confirmation of compliance.

Do not request passwords or publish sensitive operational details. Exchange documents through agreed channels. A DTS profile communicates aggregate results.

Responding to a customer questionnaire

Answer for the contracted service and describe limitations. Do not present planned measures as implemented. Reference only documents you can share.

Your DTS profile can supplement the answers with its assessment status and available score. Do not assume it replaces the customer’s form or specific requirements.

Frequently asked questions