Building a Supplier Cybersecurity Questionnaire That Actually Works

Every major OEM sends cybersecurity questionnaires to their Tier-1 and Tier-2 suppliers. Most of these questionnaires are checkbox exercises that generate a false sense of security rather than revealing actual supplier risk. The supplier fills in “Yes” to every question, attaches a couple of generic policy documents, and the OEM files the response in a compliance folder that nobody opens until an audit — or worse, until a breach.

This guide shows you how to build a supplier cybersecurity assessment that actually uncovers risk. We will cover why traditional questionnaires fail, how to design evidence-based assessments aligned with ISO/SAE 21434 Clause 7, a scoring methodology with maturity levels, evidence requirements, and how to move from point-in-time assessments to continuous supplier monitoring.

Why Traditional Supplier Questionnaires Fail

The typical supplier cybersecurity questionnaire suffers from several fundamental problems that make it nearly useless as a risk assessment tool.

The Yes/No Trap

Binary questions such as “Do you have a vulnerability management process?” tell you nothing meaningful. A supplier can answer “Yes” whether they have a world-class automated vulnerability tracking system or a shared spreadsheet that one engineer updates quarterly. The question conflates existence with effectiveness, and every supplier knows the expected answer.

No Evidence Requirements

Questionnaires that do not require evidence of implementation allow suppliers to describe aspirational processes rather than actual practices. A supplier may have a beautifully written secure development policy — created specifically for the questionnaire response — that bears no resemblance to how their engineers actually work.

No Verification Mechanism

Self-assessment without verification is a compliance fiction. Without mechanisms to validate supplier responses — through technical evidence, tool artifact review, or on-site assessment — the entire exercise becomes a trust exercise dressed up as risk management.

Point-in-Time Snapshot

Traditional questionnaires capture a snapshot of supplier capabilities at a single moment. Security posture changes constantly as staff turn over, tools change, and new vulnerabilities emerge. A questionnaire response from six months ago may bear little resemblance to the supplier’s current state.

One-Size-Fits-All Approach

Sending the same 200-question questionnaire to every supplier regardless of their role in the supply chain wastes everyone’s time. A supplier providing a non-connected sensor has fundamentally different cybersecurity requirements than one developing a telematics control unit with cellular connectivity.

We reviewed over 40 OEM supplier questionnaires during our consulting engagements. Fewer than five required any form of evidence beyond policy documents, and none included technical verification of responses. The correlation between questionnaire scores and actual security posture was essentially random.

ISO/SAE 21434 Clause 7: Distributed Cybersecurity Activities

ISO/SAE 21434 Clause 7 establishes the foundation for managing cybersecurity across the supply chain. Understanding this clause is essential for designing an effective questionnaire.

What Clause 7 Requires

Clause 7 mandates that when cybersecurity activities are distributed across organizational boundaries — as they always are in automotive — the responsible party must ensure that:

• Cybersecurity responsibilities are clearly defined in agreements between customer and supplier, including which party performs which activities.
• Supplier capability is assessed to confirm the supplier can fulfill their assigned cybersecurity responsibilities.
• Interfaces are established for cybersecurity-relevant communication, including vulnerability disclosure, incident notification, and change management.
• Evidence of execution is available to demonstrate that distributed activities were performed according to agreed requirements.

The Cybersecurity Interface Agreement (CIA)

Clause 7 expects a formal cybersecurity interface agreement — sometimes called a cybersecurity development agreement — between customer and supplier. This agreement defines the cybersecurity activities each party performs, the work products to be exchanged, and the communication mechanisms for cybersecurity events. Your questionnaire should assess whether the supplier can fulfill these agreement requirements.

Designing an Evidence-Based Assessment Framework

An effective supplier cybersecurity questionnaire moves beyond binary questions to graduated maturity assessment with evidence requirements at each level.

Tiered Supplier Classification

Before sending a questionnaire, classify your suppliers by cybersecurity relevance:

• Tier A (Critical): Suppliers developing software or hardware for safety-critical or externally connected ECUs. Full assessment required including on-site review.
• Tier B (Significant): Suppliers developing components with cybersecurity relevance but lower exposure. Detailed self-assessment with evidence and remote verification.
• Tier C (Standard): Suppliers providing non-connected, non-safety components. Abbreviated assessment focused on basic hygiene and SBOM capability.

This classification prevents assessment fatigue while ensuring critical suppliers receive appropriate scrutiny.

Maturity-Based Questions

Replace yes/no questions with maturity-level descriptions. Instead of asking “Do you have a vulnerability management process?”, present five levels and ask the supplier to self-assess against specific criteria:

1. Level 1 — Initial: No formal process. Vulnerabilities addressed reactively when discovered by customers or disclosed publicly.
2. Level 2 — Managed: Basic process exists. Vulnerability sources monitored manually. Tracking via spreadsheet or ticketing system.
3. Level 3 — Defined: Documented process with defined SLAs. Automated vulnerability scanning for known CVEs. Formal triage and prioritization.
4. Level 4 — Quantitatively Managed: Metrics-driven process. Automated SBOM-based vulnerability correlation. SLA compliance tracked and reported. Root cause analysis performed.
5. Level 5 — Optimizing: Continuous improvement driven by metrics. Proactive vulnerability research. Automated patch generation and testing. Supplier’s own sub-supplier vulnerabilities tracked.

Key Question Categories

An effective automotive supplier cybersecurity questionnaire should cover the following eight categories, each assessed at the maturity levels described above.

1. CSMS Maturity

Assess the supplier’s overall Cybersecurity Management System. This includes organizational structure (dedicated cybersecurity roles vs. shared responsibilities), management commitment (budget allocation, executive sponsorship), process documentation, and continuous improvement mechanisms. Key questions explore whether the supplier has achieved any CSMS certification or third-party assessment, how cybersecurity governance is structured, and how cybersecurity policy is communicated and enforced across the organization.

2. Secure Development Process

Evaluate the supplier’s secure software and hardware development practices. This covers secure coding standards (MISRA C, CERT C), static and dynamic analysis tooling, code review practices, architecture security review, and security testing integration into CI/CD pipelines. Probe whether security activities are embedded in the development lifecycle or bolted on as a final gate. Request evidence of threat modeling performed on recent projects, security test plans, and tool configurations.

3. Vulnerability Management

Assess how the supplier identifies, tracks, and remediates vulnerabilities in their products. Key areas include vulnerability intelligence sources monitored, automated scanning capabilities (SAST, DAST, SCA), triage and prioritization process, remediation timelines and SLA compliance, and notification mechanisms for customers when vulnerabilities are discovered in shipped products. This is one of the most critical categories because post-delivery vulnerability management is a continuous obligation under ISO/SAE 21434.

4. Incident Response

Evaluate the supplier’s ability to detect, respond to, and recover from cybersecurity incidents. Assess whether the supplier has a documented incident response plan specific to product security (not just IT incidents), whether they conduct regular tabletop exercises, and whether they have defined communication channels and timelines for notifying customers of incidents. Request evidence of incident response drills and their outcomes.

5. SBOM Capability

Assess the supplier’s ability to generate, maintain, and share Software Bills of Materials. This includes SBOM format support (CycloneDX, SPDX), generation methodology (build-time vs. analysis-based), completeness (direct and transitive dependencies), update frequency, and willingness to share SBOMs with customers. Given increasing regulatory requirements around SBOM, this category has become essential for supply chain risk management.

6. Secure Coding Practices

Go deeper than the secure development process category by assessing specific technical practices. Evaluate adherence to automotive-relevant coding standards, use of memory-safe languages where appropriate, input validation and boundary checking practices, cryptographic implementation standards, and handling of sensitive data such as keys and credentials. Request examples of static analysis configurations and defect density metrics from recent projects.

7. Configuration and Change Management

Assess how the supplier manages changes to cybersecurity-relevant components throughout the product lifecycle. This includes configuration management practices, change impact assessment for cybersecurity, regression testing after changes, and the process for communicating cybersecurity-relevant changes to customers. Post-production changes are a common blind spot in supply chain security.

8. Training and Competency

Evaluate the cybersecurity knowledge and skill level of the supplier’s engineering staff. Assess training programs (content, frequency, mandatory vs. optional), certification levels (CSSLP, automotive cybersecurity certifications), awareness programs, and knowledge assessment mechanisms. A supplier may have excellent processes on paper, but without competent engineers to execute them, those processes are meaningless.

Sample Questionnaire Framework

The following table provides a framework for structuring the assessment across all eight categories. Each category is assessed at five maturity levels with specific evidence requirements.

Category	Weight	Evidence Required (Level 3+)	Key Artifacts
CSMS Maturity	15%	CSMS policy, org chart with cybersecurity roles, management review minutes	CSMS certificate or self-assessment report
Secure Development Process	20%	Secure SDLC documentation, tool configurations, sample threat models	TARA reports, security test plans, CI/CD pipeline configs
Vulnerability Management	15%	Vulnerability tracking tool exports, SLA metrics, notification templates	Vulnerability dashboard, remediation timelines, advisory samples
Incident Response	10%	IR plan, tabletop exercise reports, communication templates	IR playbook, drill after-action reports, escalation matrix
SBOM Capability	15%	Sample SBOM output, generation tool configuration, update process	CycloneDX/SPDX samples, dependency tracking tool exports
Secure Coding Practices	10%	Coding standards, static analysis tool configs, defect metrics	MISRA compliance reports, SAST/DAST scan summaries
Configuration & Change Mgmt	10%	CM process docs, change impact assessment templates, audit trails	CM tool exports, change request samples with security review
Training & Competency	5%	Training program documentation, completion records, assessment results	Training certificates, competency matrix, course materials

Scoring Methodology

A weighted scoring methodology provides a quantifiable supplier cybersecurity risk score that enables comparison across suppliers and tracking over time.

Category Scoring

Each of the eight categories receives a maturity score from 1 to 5, based on the supplier’s self-assessment and supporting evidence. The raw score is multiplied by the category weight to produce a weighted score. The sum of all weighted scores gives the overall supplier cybersecurity score on a 1–5 scale.

Evidence Validation Adjustment

For Tier A (critical) suppliers, apply an evidence validation adjustment. When evidence is reviewed and found to contradict the self-assessed maturity level, reduce the category score by one or more levels. This prevents suppliers from over-reporting their maturity, which is extremely common in self-assessment.

Risk Classification Thresholds

• 4.0–5.0 (Low Risk): Supplier demonstrates mature cybersecurity practices. Standard monitoring sufficient. Reassess annually.
• 3.0–3.9 (Moderate Risk): Supplier has adequate practices with improvement areas. Targeted improvement plan required. Reassess semi-annually.
• 2.0–2.9 (Elevated Risk): Significant capability gaps. Detailed remediation plan with milestones required. Quarterly follow-up assessments.
• 1.0–1.9 (High Risk): Fundamental cybersecurity capability deficiencies. Consider alternative suppliers or require intensive support program. Monthly monitoring until improved.

Minimum Category Thresholds

Beyond the overall score, enforce minimum thresholds for critical categories. For Tier A suppliers, no individual category should score below Level 2, and Vulnerability Management and Secure Development Process should score at least Level 3. A supplier with an overall score of 3.5 but a Vulnerability Management score of 1 represents an unacceptable risk regardless of their strengths in other areas.

Evidence Requirements: What to Ask For vs. What to Accept

The quality of your assessment depends entirely on the quality of evidence you require and how critically you evaluate it.

Strong Evidence

• Tool artifacts: Exports from security testing tools (SAST scan reports, vulnerability tracker dashboards, SBOM outputs) are difficult to fabricate and provide concrete data points.
• Dated records: Meeting minutes with dates, training completion records with timestamps, and incident response drill reports with specific findings demonstrate actual execution.
• Metrics and trends: Vulnerability remediation timelines, defect density trends, and SLA compliance rates show process maturity and consistency over time.
• Third-party assessments: Independent audit reports, certification evidence, and penetration test results from recognized firms provide verified assurance.

Weak Evidence

• Policy documents alone: A well-written policy tells you nothing about implementation. Always pair policy review with implementation evidence.
• Self-attestation statements: Statements like “We follow industry best practices” without supporting artifacts are meaningless.
• Undated materials: Documents without dates or version control could be from any point in time and may not reflect current practices.
• Generic templates: Off-the-shelf templates filled in with company-specific names but no real customization indicate a process exists only on paper.

Red Flags

Watch for these indicators that suggest a supplier’s self-assessment may not reflect reality:

• All categories self-assessed at the same level (especially if all are Level 4 or 5)
• Evidence artifacts all created or dated within a narrow window (suggesting they were produced specifically for the assessment)
• No mention of challenges, gaps, or improvement plans (unrealistic maturity claims)
• Reluctance to share tool configurations or sample outputs (may indicate tools are not actually in use)
• All documents formatted identically (suggesting generation from a single template rather than organic process documentation)

Automated Supplier Assessment Workflows

Manual questionnaire processes do not scale. An OEM with 200+ Tier-1 suppliers, each with their own sub-suppliers, cannot effectively manage cybersecurity assessments through email and spreadsheets.

Workflow Automation Components

• Questionnaire distribution and tracking: Automated dispatching of role-appropriate questionnaires based on supplier classification, with deadline tracking and automated reminders.
• Evidence collection portal: Secure upload portal for suppliers to submit artifacts. Automated validation checks ensure completeness before submission.
• Automated scoring: Where evidence is machine-readable (SBOM files, scan reports, tool exports), automate scoring to reduce manual review burden.
• Dashboard and reporting: Aggregated view of supplier risk landscape. Trend analysis showing improvement or degradation across the supply chain.
• Integration with procurement: Feed supplier cybersecurity scores into sourcing decisions and contract negotiations.

SBOM-Based Continuous Assessment

SBOMs enable a fundamentally different approach to supplier vulnerability management. Instead of asking suppliers about their vulnerability management process and trusting their response, you can independently verify their component exposure:

• Collect SBOMs from suppliers as part of delivery artifacts
• Correlate SBOM components against vulnerability databases (NVD, VulnDB, supplier-specific advisories)
• Track remediation timelines when vulnerabilities are disclosed in supplier components
• Measure actual supplier responsiveness to vulnerability notifications

This transforms the relationship from trust-based to evidence-based, and from periodic to continuous.

Continuous Monitoring vs. Point-in-Time Assessments

The automotive industry is shifting from annual supplier assessments to continuous monitoring models. This shift is driven by the recognition that cybersecurity risk is dynamic and that annual snapshots provide insufficient assurance.

Continuous Monitoring Signals

• SBOM vulnerability correlation: Ongoing matching of supplier component inventories against emerging vulnerability data.
• Supplier communication responsiveness: How quickly does the supplier respond to vulnerability notifications and information requests?
• Public vulnerability disclosures: Monitoring public sources for vulnerabilities in supplier products.
• Supplier security incidents: Tracking publicly disclosed breaches, ransomware incidents, or supply chain compromises affecting your suppliers.
• Certification status changes: Monitoring for expiration or revocation of supplier certifications (ISO 27001, CSMS certificates).

Triggered Reassessments

Define events that trigger immediate partial or full reassessment outside the regular cycle:

• Critical vulnerability discovered in a supplier-delivered component with no timely remediation
• Supplier experiences a cybersecurity incident affecting their development environment
• Significant organizational changes at the supplier (acquisitions, key personnel departures)
• Change in supplier classification (component moved to a higher criticality tier)
• Failed audit at the supplier affecting cybersecurity-relevant processes

Contractual Cybersecurity Requirements

The assessment questionnaire should align with contractual requirements. Without contractual backing, questionnaire findings have no enforcement mechanism.

Essential Contract Clauses

• Cybersecurity obligations: Explicitly reference ISO/SAE 21434 Clause 7 and define the supplier’s cybersecurity responsibilities for the specific component or system.
• SBOM delivery requirements: Specify format (CycloneDX or SPDX), delivery timing (with each release), completeness requirements (transitive dependencies), and update obligations.
• Vulnerability notification timelines: Define maximum notification time from supplier discovery of a vulnerability to customer notification (typically 24–72 hours for critical vulnerabilities).
• Patch delivery SLAs: Specify maximum remediation timelines based on vulnerability severity (e.g., critical: 30 days, high: 60 days, medium: 90 days).
• Right to audit: Reserve the right to conduct cybersecurity audits of the supplier’s processes, tools, and facilities with reasonable notice.
• Incident response cooperation: Require the supplier to cooperate in incident investigation, provide forensic data, and participate in coordinated response activities.
• Sub-supplier flow-down: Require the supplier to impose equivalent cybersecurity requirements on their own suppliers for cybersecurity-relevant components.
• Continuous improvement obligations: Require the supplier to maintain or improve their cybersecurity maturity score over the contract period, with defined escalation for declining scores.

Implementation Roadmap

Transforming your supplier assessment program from checkbox questionnaires to evidence-based continuous monitoring is not an overnight project. A phased approach ensures manageable implementation.

Phase 1: Foundation (Months 1–3)

• Classify existing suppliers into Tier A/B/C based on component criticality
• Design maturity-based questionnaire for each tier
• Define evidence requirements and scoring methodology
• Update procurement contracts with essential cybersecurity clauses

Phase 2: Initial Assessment (Months 3–6)

• Distribute questionnaires to all Tier A suppliers first
• Conduct evidence review and validation for critical suppliers
• Establish baseline supplier cybersecurity risk scores
• Identify suppliers requiring remediation plans

Phase 3: Automation (Months 6–12)

• Deploy supplier assessment portal with automated workflows
• Implement SBOM collection and automated vulnerability correlation
• Integrate supplier scores with procurement and risk dashboards
• Extend assessment to Tier B suppliers

Phase 4: Continuous Monitoring (Month 12+)

• Activate continuous monitoring signals for all assessed suppliers
• Implement triggered reassessment workflows
• Track supplier improvement trends and benchmark across supply base
• Extend to Tier C suppliers with abbreviated assessment

How ThreatZ Automates Supplier Assessment

ThreatZ provides purpose-built tools for automotive supplier cybersecurity management, eliminating the manual effort that makes traditional approaches unsustainable at scale.

• Automated SBOM collection: Collect and normalize SBOMs from suppliers in any standard format. Automated completeness validation ensures SBOMs meet your quality requirements.
• Continuous vulnerability correlation: Real-time matching of supplier SBOM components against NVD, VulnDB, and OEM-specific vulnerability databases. Automated alerts when new vulnerabilities affect supplier components.
• Supplier risk scoring: Weighted, configurable risk scores that combine questionnaire responses, evidence validation results, SBOM vulnerability data, and communication responsiveness into a single supplier risk metric.
• Assessment workflow automation: Configurable questionnaire templates per supplier tier with automated distribution, tracking, reminders, and evidence collection.
• Supply chain dashboard: Aggregate view of cybersecurity risk across your entire supply chain with drill-down into individual supplier details, trend analysis, and compliance status tracking.

Key Takeaways

• Binary yes/no questionnaires create a false sense of security. Replace them with maturity-based assessments requiring evidence at each level.
• Classify suppliers by cybersecurity relevance and tailor assessment depth accordingly to avoid assessment fatigue.
• ISO/SAE 21434 Clause 7 provides the regulatory foundation for supplier cybersecurity requirements and should anchor your questionnaire design.
• Evidence quality matters more than evidence volume. Tool artifacts, dated records, and third-party assessments are far more valuable than policy documents alone.
• SBOM-based continuous vulnerability monitoring transforms supplier assessment from trust-based to evidence-based.
• Contractual backing is essential. Without enforceable obligations, questionnaire findings have no teeth.
• Automate everything possible. Manual questionnaire processes do not scale across a complex automotive supply chain.