Your Biggest Customer Is About to Send Security Paperwork

The controller at a 60-person machine shop opens an email from their largest customer's purchasing team. It is polite. It has a link to a supplier portal and a deadline three weeks out. Behind the link are 80 questions about passwords, backups, laptops, and who can get into what.

Nobody at the shop has seen anything like it before. The controller forwards it to the owner. The owner forwards it to the person who "does the computers." Two weeks later, it is still sitting in three inboxes.

This is becoming a normal part of being a supplier. Big companies have learned that a break-in at a small vendor can become their problem too. So before they renew a contract, add a new part number, or share drawings, they want something in writing about how you protect their information.

Why it is landing now

For defense work, there is a date on it. On November 10, the Defense Department's CMMC (its cybersecurity rules for companies that work on defense contracts) program moves into its second phase. Under the rule, the first phase let most companies assess themselves. Starting with the second, contracts involving sensitive defense information can require an independent assessor to check the work instead.

The rule also says prime contractors must pass those requirements down to any supplier who will handle that information. They have to confirm the supplier's status before they share it or award the work. If you make parts for a company that builds for the military, expect the question even if you have never signed a defense contract yourself.

If you do defense work, our manufacturing page covers that path in more detail. But defense is only the loudest example. Large manufacturers, general contractors, distributors, and retailers send their own versions for their own reasons. Their insurers ask them about their suppliers, and they pass the question down to you.

What actually goes wrong

Nobody owns it. The questionnaire comes to whoever handles the customer relationship. It is not their area, so it sits. A missed deadline reads to the customer as a "no."

Someone guesses. The fastest way through 80 questions is to answer "yes" to each one. That feels harmless. It is not. Many of these forms end with a signature saying the answers are true. If something goes wrong later, the customer's lawyers will have that page.

The questions use words nobody in the building uses. "Do you enforce least privilege?" means "does each person only have access to what their job needs?" Plenty of companies already do the thing and simply do not recognize the jargon.

There is nothing to attach. Some questions ask for proof, like a written policy or a backup test record. If it lives only in one person's head, the honest answer is "no," even when the practice is real.

Every customer sends a different form. Answer each one from scratch and you will give slightly different answers each time. Customers sometimes compare notes.

What the questions are really asking

The wording varies, but almost every questionnaire comes back to the same handful of topics. We covered a very similar list in what your cyber insurance renewal asks, because insurers and customers worry about the same things.

Sign-ins. Do you use MFA (the extra code you get on your phone when you sign in) for email and remote access? This is usually the first question, and often the one that decides the rest.

Backups. Do you have copies of your data that an attacker could not delete, and have you ever tested restoring them?

Updates. Are your computers and servers getting security fixes, and is anything running software that no longer gets them?

Access. When someone leaves, how fast are their accounts shut off? Who has administrator rights, and why?

Their data specifically. Where do their drawings, prices, and specs live? Who in your company can open them? Do they ever go to a personal email or a thumb drive?

What happens if something breaks. Do you have a plan for a break-in, and would you tell them if it touched their information?

None of those require a large IT budget. They require knowing the honest answer and being able to show it.

What good looks like

A company in good shape treats the questionnaire as a routine document, not an emergency.

One owner. A single person, often the controller or operations manager, owns customer security requests. They pull in IT for the technical answers, but the deadline is theirs.

A master answer sheet. The first questionnaire becomes the template for the next one. Each answer is written once, in plain words, with a date. When the fifth customer asks, most of the work is copying.

Honest gaps, with dates. "Not yet. We are rolling out MFA to the shop floor accounts and expect to finish by January" is a strong answer. Customers expect small suppliers to be working on things. They do not expect, or forgive, a "yes" that turns out to be false.

A folder of proof. A one-page security policy, a backup test record, a list of who has administrator access. Short is fine. Current matters more than long.

What to do about it this month

Ask your top three customers. A short email to your purchasing contacts works: "Are you planning to send supplier security requirements this year?" You would rather know now than with a three-week deadline.

Fix the first question first. If MFA is not on for email and remote access, do that before anything else. It is the answer most forms care most about, and it closes a real gap.

Find out where customer files live. Walk through how a drawing travels from the customer to the machine. Note every inbox, shared drive, and laptop it touches along the way.

Start the answer sheet. Take any questionnaire you have, or the list above, and write one honest sentence for each topic. Mark the "not yet" items with an owner and a month.

Do not sign what you cannot back up. If an answer is uncertain, say so and give a date. A careful "partially" protects you far better than a confident "yes."

Want help before the deadline does?

Most companies we meet answer half of these questions well already. They just cannot prove it, or they phrase it in a way the customer reads as "no."

Our free IT assessment gives you the honest answers to the questions customers actually ask. You get a plain list of what is in place, what is missing, and what to fix first. Use it to fill out the next questionnaire yourself, or hand it to whoever runs your security. Either way, the next email from purchasing becomes a form, not a fire drill.