Do trust centres replace security questionnaires?

A trust centre replaces a security question in a tender only when the buyer's documents allow it. Your trust centre is your page, written and controlled by you. The questionnaire belongs to the buyer, and the buyer decides what counts as an answer. Even where a reference is allowed, you sign off what each link commits the organisation to, because it becomes part of the response you answer for.

It's worth being clear about which situation you're in, because the answer changes. Outside a formal tender, the buyer's security team may be happy to start from your trust centre and only come back with the questions it doesn't answer. That might be a security review during a sale, or the due diligence a customer runs before signing. A formal tender works differently. The buyer has already decided its questions, how they'll be evaluated and what counts as evidence. So a link that would satisfy a security team in a sales conversation can leave a tender question unanswered. This article is about tenders.

Five conditions decide it, and a rule at the end turns them into a call you can make question by question.

When the buyer accepts a certificate instead of answers

Published evidence stands in for a security question only when the buyer chooses to accept it, and the tender's instructions tell you whether it has. You can make evidence easy to reach. You can't make it count.

The UK's National Cyber Security Centre shows where that decision sits. Its Cyber Essentials supply chain playbook suggests buyers align their supply chain assurance questionnaires with Cyber Essentials controls and accept a certification as validation. It also tells suppliers they can reuse one certification across their customers, so one certificate can serve many customers. That's a government-backed scheme, and it still depends on each buyer writing acceptance into its own questions. A supplier's own trust centre has no scheme behind it, so nothing gives it standing in a tender unless the documents do.

So read the pack for permission, not for opportunity. Look for wording in the instructions, the questionnaire's guidance or the question itself that names a certificate, a registry entry or a published policy as acceptable evidence. As an illustration (not a quoted tender), such a line might read: "Bidders holding a current ISO/IEC 27001 certificate covering the services in scope may submit it in place of answering questions 4.1 to 4.6." Where the pack has such a line, a reference may meet the question, subject to the checks below. Where the pack is silent, treat the question as one that expects an answer in the response. If a reference would save real effort across many questions, ask the buyer through a clarification question whether it will be accepted, and plan as though the answer is no until it arrives.

When security is a scored question

A scored security question is marked against the buyer's criteria, so treat a link to your trust centre as support for the answer, not a replacement for it. The marks go to what the response itself shows against each criterion.

The NCSC playbook notes that buyers may add weighted criteria assessing a supplier's cybersecurity credentials to a request for proposal or quotation. A certificate tells the evaluator that a control exists. A scored answer has to say how that control applies to this contract, this data and this service, in the terms the criteria use, and leave the evaluator nothing to infer.

That changes what the link is for. In a scored answer, the reference is a citation: it lets the evaluator check a claim the answer already makes. Write the answer so it would earn its marks if the evaluator never clicked through, then cite the certificate or policy at the point where it backs a specific statement. For the method of building that answer against the buyer's marking scheme, see how to write a tender bid.

One quick test before review: read the answer with every link removed. If it would score lower, it was leaning on the link.

When the published evidence is self-assessed

A public self-assessment leaves the question open. A trust centre can mix evidence of different strength, and audited evidence gives a buyer more assurance than a self-assessment.

The Cloud Security Alliance's STAR programme for cloud providers draws a clear line. At Level 1, a provider submits the CAIQ against the Cloud Controls Matrix as a self-assessment, which CSA publishes and which must be updated annually. At Level 2, the provider earns a certification or third-party attestation. CSA positions Level 1 for organisations in low-risk environments that want more transparency over their controls, and Level 2 for medium- to high-risk environments. A self-assessed entry is your own declaration, made public. An audited one is someone else's verification. If the contract is medium or high risk, where CSA points to Level 2, a self-assessment invites exactly the question you hoped to avoid.

When the evidence doesn't cover the service you're bidding

Evidence whose scope stops short of the service you're bidding leaves the question open, however strong that evidence is. The NCSC says it is the customer's responsibility to check that a certificate's scope adequately covers the risk they're taking on. Read from your side, that means a careful evaluator will compare your certificate's scope with the service in your bid. For example, a certification covering your corporate systems but not the environment that hosts the proposed service says little about that service. Where the scope doesn't cover what you're bidding, answer the question about the service itself and leave the certificate out of it. Where it does, say so in the answer: name the scope and show how it covers the service, so the evaluator doesn't have to work it out.

When the evidence sits behind an NDA

Evidence the evaluator can't open isn't evidence in your response, so a gated trust centre document needs an agreed route to the evaluator before you rely on it. Trust portals can hold back their most sensitive material. Microsoft's Service Trust Portal, for example, places some documents behind sign-in and asks the reader to accept Microsoft's non-disclosure agreement for compliance materials first.

You can't assume an evaluator will sign your NDA to read one answer, and the tender's own rules may limit what they can accept. That leaves two routes, depending on the pack. Where the tender's confidentiality terms cover material a bidder marks as confidential, attach the document to the response under those terms, once whoever controls its release has agreed. Where the pack doesn't say how confidential evidence is handled, raise a clarification question before you plan around it.

Either way, the answer itself should state what the gated document shows. Then the score doesn't depend on whether access works on the day.

What to do with each security question in the pack

Run every security question through the same five checks, then answer, answer and cite, or refer, and sign off each reference as part of the response. Skipping the checks leaves you with answers that lean on evidence the buyer doesn't accept, can't score or can't open.

Five checks per question

1. References permitted. Do the instructions, guidance or question accept a certificate, registry entry or published page as evidence?
2. Scored or pass/fail. Is the question marked against weighted criteria, or checked for compliance?
3. Assurance level. Is the evidence third-party certified or attested, or is it a self-assessment?
4. Scope. Does the evidence cover the service you're bidding?
5. Access. Can the evaluator open it without an NDA they haven't agreed to?

The decision rule

Apply these in order and take the first that fits:

1. Refer when all five checks pass: references are permitted, the question is pass/fail, the evidence is audited, it covers the service, and the evaluator can open it. Give the reference exactly as the instructions ask.
2. Answer and cite when the scope and access checks pass but any of the first three fails: references aren't permitted, the question is scored, or the evidence is self-assessed. Write the full answer against the question or its criteria, and cite the evidence where it backs a specific claim. Cite a self-assessment as context, never as proof that the control works.
3. Answer when the evidence doesn't cover the service, or the evaluator can't open it. Write the answer from what is true of that service. For gated evidence, say in the answer what the document shows, and offer the document through the route the NDA section describes.

Before sign-off

Sign off a reference the way you sign off an answer, because it puts the page's content in front of the buyer as part of your response. Before submission, open each page you cite and check that it matches the answer beside it on that day: the certificate is current, the scope is the one your answer describes, and the policy version is the one your answer draws on. Where the page and the answer disagree, the buyer now holds both, and you answer for the gap. Record the version you cited, so you can show later what the response pointed to.

That check gets lighter when trust centre content and bid answers come from the same approved source. In the Knowledge Hub, part of SEQUESTO aOS, each approved security answer keeps its owner, review cycle and expiry date, and answers drawn from a policy are flagged for review when that policy is updated. For what makes the answers you still write stand up under review, see defensible security questionnaire answers. For keeping approved answers owned and dated, so published and bid answers stay aligned, see building an auditable library.

Start with the pack in front of you. Run the five checks on its security questions before anyone drafts, and you'll know which questions need writing, which need a citation and which need only a reference.