Do trust centers replace security questionnaires?

A trust center replaces a security question in a tender only when the buyer's documents allow it. Your trust center is your page, written and controlled by you. The questionnaire belongs to the buyer, and the buyer decides what counts as an answer. Even where a reference is allowed, you sign off what each link commits the organisation to, because it becomes part of the response you answer for.

Four conditions decide it, and a rule at the end turns them into a call you can make question by question.

When the buyer accepts a certificate instead of answers

Published evidence stands in for a security question only when the buyer chooses to accept it, and the tender's instructions tell you whether it has. You can make evidence easy to reach. You can't make it count.

The UK's National Cyber Security Centre shows where that decision sits. Its Cyber Essentials supply chain playbook suggests buyers align their supply chain assurance questionnaires with Cyber Essentials controls and accept a certification as validation. It also tells suppliers they can reuse one certification across their customers, cutting the time spent on duplicative questionnaires. That's a government-backed scheme, and it still depends on each buyer writing acceptance into its own questions. A supplier's own trust center has no scheme behind it, so nothing gives it standing in a tender unless the documents do.

So read the pack for permission, not for opportunity. Look for wording in the instructions, the questionnaire's guidance or the question itself that names a certificate, a registry entry or a published policy as acceptable evidence. As an illustration (not a quoted tender), such a line might read: "Bidders holding a current ISO/IEC 27001 certificate covering the services in scope may submit it in place of answering questions 4.1 to 4.6." Where the pack has such a line, a reference may meet the question, subject to the checks below. Where the pack is silent, treat the question as one that expects an answer in the response. If a reference would save real effort across many questions, ask the buyer through a clarification question whether it will be accepted, and plan as though the answer is no until it arrives.

When security is a scored question

A scored security question is marked against the buyer's criteria, so treat a link to your trust center as support for the answer, not a replacement for it. The marks go to what the response itself shows against each criterion.

The NCSC playbook notes that buyers may add weighted criteria assessing a supplier's cybersecurity credentials to a request for proposal or quotation. A certificate tells the evaluator that a control exists. A scored answer has to say how that control applies to this contract, this data and this service, in the terms the criteria use, and leave the evaluator nothing to infer.

That changes what the link is for. In a scored answer, the reference is a citation: it lets the evaluator check a claim the answer already makes. Write the answer so it would earn its marks if the evaluator never clicked through, then cite the certificate or policy at the point where it backs a specific statement. For the method of building that answer against the buyer's marking scheme, see how to write a tender bid.

One quick test before review: read the answer with every link removed. If it would score lower, it was leaning on the link.

When the published evidence is self-assessed or out of scope

A trust center can mix evidence of different strength, and audited evidence that covers the service on offer gives a buyer more assurance than a self-assessment or a certificate scoped elsewhere. A public self-assessment, or a scope that stops short of the service, leaves the question open.

The Cloud Security Alliance's STAR programme for cloud providers draws a clear line. At Level 1, a provider submits the CAIQ against the Cloud Controls Matrix as a self-assessment, and CSA publishes and updates the answers annually. At Level 2, the provider earns a certification or third-party attestation. CSA positions Level 1 for organisations in low-risk environments that want more transparency over their controls, and Level 2 for medium- to high-risk environments. A self-assessed entry is your own declaration, made public. An audited one is someone else's verification. If the contract is medium or high risk, where CSA points to Level 2, a self-assessment invites exactly the question you hoped to avoid.

Scope is the second test. The NCSC says it is the customer's responsibility to check that a certificate's scope adequately covers the risk they're taking on. Read from your side, that means a careful evaluator will compare your certificate's scope with the service in your bid. For example, a certification covering your corporate systems but not the environment that hosts the proposed service says nothing about that service. Where the scope doesn't cover what you're bidding, answer the question about the service itself and leave the certificate out of it. Where it does, say so in the answer: name the scope and show how it covers the service, so the evaluator doesn't have to work it out.

When the evidence sits behind an NDA

Evidence the evaluator can't open isn't evidence in your response, so a gated trust center document needs an agreed route to the evaluator before you rely on it. Trust portals can hold back their most sensitive material. Microsoft's Service Trust Portal, for example, places some documents behind sign-in and asks the reader to accept Microsoft's non-disclosure agreement for compliance materials first.

You can't assume an evaluator will sign your NDA to read one answer, and the tender's own rules may limit what they can accept. That leaves two routes, depending on the pack. Where the tender's confidentiality terms cover material a bidder marks as confidential, attach the document to the response under those terms, once whoever controls its release has agreed. Where the pack doesn't say how confidential evidence is handled, raise a clarification question before you plan around it.

Either way, the answer itself should state what the gated document shows. Then the score doesn't depend on whether access works on the day.

What to do with each security question in the pack

Run every security question through the same four checks, then answer, answer and cite, or refer, and sign off each reference as part of the response. Skipping the checks leaves you with answers that lean on evidence the buyer doesn't accept, can't score or can't open.

Four checks per question

1. References permitted. Do the instructions, guidance or question accept a certificate, registry entry or published page as evidence?
2. Scored or pass/fail. Is the question marked against weighted criteria, or checked for compliance?
3. Assurance level. Is the evidence third-party certified or attested, or is it a self-assessment?
4. Scope and access. Does the evidence's scope cover the service you're bidding, and can the evaluator open it without an NDA they haven't agreed to?

The decision rule

Apply these in order and take the first that fits:

1. Refer when all four checks pass: references are permitted, the question is pass/fail, the evidence is audited, and it covers the service and is open to the evaluator. Give the reference exactly as the instructions ask.
2. Answer and cite when the evidence covers the service and the evaluator can open it, but any other check fails. Write the full answer against the question or its criteria, and cite the evidence where it backs a specific claim. Cite a self-assessment as context, never as proof that the control works.
3. Answer when the evidence doesn't cover the service or is locked to the evaluator. Write the answer from what is true of that service, and leave the reference out.

Before sign-off

Sign off a reference the way you sign off an answer, because it puts the page's content in front of the buyer as part of your response. Before submission, open each page you cite and check that it matches the answer beside it on that day: the certificate is current, the scope is the one your answer describes, and the policy version is the one your answer draws on. Where the page and the answer disagree, the buyer now holds both, and you answer for the gap. Record the version you cited, so you can show later what the response pointed to.

That check gets lighter when trust center content and bid answers come from the same approved source. In the Knowledge Hub, part of SEQUESTO aOS, each approved security answer keeps its owner, review cycle and expiry date, and answers drawn from a policy are flagged for review when that policy is updated. For what makes the answers you still write stand up under review, see defensible security questionnaire answers. For keeping approved answers owned and dated, so published and bid answers stay aligned, see building an auditable library.

Start with the pack in front of you. Run the four checks on its security questions before anyone drafts, and you'll know which questions need writing, which need a citation and which need only a reference.