Cyber Security and Resilience Bill supplier questionnaire: sample answers
There is no official supplier questionnaire for the Cyber Security and Resilience Bill (CSRB). Customers write their own. A good answer states your actual position, gives evidence and avoids promising compliance with duties that may not apply to you. These unofficial examples can be adapted.
The Bill is not yet law. Regulation and section references come from the Bill as brought from the Commons (HL Bill 32). The Lords has since amended the Bill, so numbering and detail may change in the final Act. This guide is general information, not legal advice.
How to use these
These are unofficial examples for suppliers answering questions about the Cyber Security and Resilience Bill (CSRB). Replace the bracketed text and delete anything that is not true. An inaccurate answer could become a contract problem, so have the right person check it.
Questions about scope
Are you regulated under the Bill?
The Bill has not yet become law. Based on our assessment dated [date], we [expect / do not expect] to be regulated as [category]. We have reviewed the [managed service / relevant digital service / Schedule 2] tests and will revisit this when the final Act and regulations are published.
Have you been designated as a critical supplier?
We have not received any notice of proposed designation from a regulator. We will tell you if this changes, subject to any legal limits on doing so.
Are you exempt as a small enterprise?
We have assessed our staff numbers, turnover and balance sheet, including linked businesses, against Commission Recommendation 2003/361/EC. On that basis, we [do / do not] consider ourselves a micro or small enterprise.
Questions about incidents
How quickly will you notify us of an incident?
We will notify your named contact [within X hours] of confirming a security incident likely to affect your service. We will share what we know at that stage and update you as we learn more.
Pick a time you can actually meet at 3am on a holiday weekend. If you are regulated, the Bill's customer duty applies after your full notification, as soon as reasonably practicable, but your contract may require faster notice.
Will your notice include enough for our own 24-hour report?
Our first notice will include the affected service, the time we became aware, a brief description, whether it is ongoing and a contact. We can share further detail as it is established, where we are able to.
This matches the kinds of details regulated customers need. It does not promise to find a root cause in that time.
Do you test your incident response?
We last exercised our incident response on [date], covering [scenario]. We can share a summary.
Questions about security
Do you follow the Cyber Assessment Framework?
We [have / have not] assessed ourselves against the NCSC Cyber Assessment Framework. Our security programme is based on [framework], and we can share [certificate / summary].
Do not claim CAF alignment without an assessment behind it.
What certifications do you hold?
We hold [certificate], covering [scope], valid until [date].
Always include scope. A certificate that excludes the service your customer buys does not help them.
Do you use multi-factor authentication on administrative and remote access?
[Yes, enforced for all / Yes, except for: ...]. We review this [frequency].
If the true answer has exceptions, state them.
Who else can access our data or systems?
The following sub-processors or suppliers have access in connection with this service: [list or link]. We assess them by [method].
Questions about contracts
Will you agree to comply with the Bill?
We will comply with laws that apply to us. As the Bill is not yet law and its application depends on each organisation's status, we propose specific security and notification commitments in place of a general clause. We are happy to revisit this when the final requirements are known.
Will you allow audits?
We can support assurance through [certificates, summaries, questionnaires]. We can discuss audit rights where necessary, with agreed scope, notice and confidentiality.
Answers to avoid
- "We are fully compliant with the Bill." The law and detail are not final.
- "Not applicable." Explain why, or the customer will ask again.
- "Yes" to every control. Blanket answers are easy to disprove after an incident.
- Promises you cannot monitor. Check that someone owns each commitment.
Sources
- The Bill as brought from the Commons (HL Bill 32), regulations 11, 14E, 14G and 14H
- Government incident reporting factsheet
- NCSC Cyber Assessment Framework
Frequently asked questions
We have not found one. Customers write their own, often based on existing frameworks or their regulator’s expectations.
Avoid that wording. The Bill is not yet law, and its duties depend on your status. Describe your status and the measures you actually have in place.
You can usually offer a summary or attestation instead of the full report, unless your contract says otherwise. Agree this with the customer and protect sensitive detail.
Someone who knows the facts, usually security or compliance, with legal or commercial review for anything that becomes a contractual promise.