COMPLIANCE QUESTIONS
Are cyber compliance questions holding up your contracts?
These are the questions The Rybec Group clients face most often:
Do you hold Cyber Essentials or Cyber Essentials Plus certification?
Can you provide evidence of ISO 27001 compliance?
How do you manage data protection and UK GDPR compliance?
What is your process for responding to a cyber security incident?
Do you have a documented business continuity plan?
How do you manage the cyber security risk posed by your own suppliers and subcontractors?
If Cyber Essentials is required, we guide you through certification as an IASME Certification Body.
If Cyber Essentials Plus is specified, we prepare you for the technical assessment.If ISO 27001 is required, we scope the implementation and manage it end to end.
If the requirement is for specific policies, risk documentation or GDPR evidence, we build those with you.
If you do not have confident, evidenced answers to these questions, you are at a disadvantage in any competitive tender and potentially disqualified at the first stage before the procurement team has evaluated your actual proposition.
OUR SERVICES
Why procurement teams ask these questions
Cyber risk does not stop at an organisation's own boundary. When a larger business works with a supplier or subcontractor that has weak cyber controls, they absorb some of that risk. A supplier's data breach can expose client data. A compromised supplier system can provide an entry point into a client's network.
Regulatory pressure is increasing. The UK Cyber Security and Resilience Bill, expected to become law in late 2026, introduces new obligations for organisations in critical and regulated sectors, with a specific focus on supply chain security. Private sector clients with regulated obligations are already passing those requirements on to their suppliers, and the direction of travel is clear.
The businesses best placed to win and keep contracts are those that can demonstrate their cyber security is managed, documented and independently verified.
PQQ QUESTIONS
What PQQ questions are really asking
When a PQQ asks whether you have a cyber security policy, it is asking whether you have thought seriously about information security risk. When it asks about incident response, it is asking whether you know what to do if something goes wrong. When it asks for certification, it is asking for independent evidence that your answers are backed by real controls.
The Rybec Group helps you understand what each question requires, so you can answer it in a way that meets the procurement team's expectations rather than just filling in the box.
Getting contract-ready
The Rybec Group's approach for supply chain clients starts with a conversation about what you are being asked for and what you currently have in place. From there, we build a route map:
Most clients find that one clear conversation about what is needed prevents months of uncertainty and prevents money being spent in the wrong direction.
