Supplier security file
Swiss data protection compliance, security policies and penetration tests for SMEs
Certenor brings your SME into Swiss data protection compliance in six weeks, writes your security policies, has your systems tested by a qualified partner and turns it all into dated evidence. When a client sends a security questionnaire, the answer is ready in two days.
Gather the requirements and the existing evidence
Draft the answers and name the gaps
Approve the file and track the actions
Who it is forSoftware vendors, agencies and suppliers selling to large corporates, banks or public bodies.
In 30 seconds
Your enterprise clients send questionnaires. Certenor turns what you already do into dated evidence, reusable for every client.
Eighty questions, ten days, a deal at stake.
Library of evidenced answers, declared gaps, remediation plan.
Every statement backed by dated evidence, in two days instead of ten.
Not a statement, not a procedure: the dated record that a control was executed. That is what an auditor checks.
A missing control, declared as such with an owner and a deadline. An owned gap lands better than an invented yes.
A public security page with your evidence kept current, which halves incoming questionnaires.
The revised Swiss law in force since 2023. Record of processing and procedures are mandatory for most companies.
Most companies that fail a supplier questionnaire are not badly secured. They are unable to demonstrate what they do. Backups exist but no procedure is written. Access is reviewed, but from memory, with no record. Encryption is in place, but nobody can say on exactly which data.
The questionnaire does not measure your security: it measures your ability to document it. A cautious client treats absent evidence as an absent control, and is right to do so.
The second difficulty is repetition. Every client has its own form, with the same questions worded differently. Without a library, everything is rewritten each time, and the answers drift from one client to the next. That drift is exactly what an auditor picks up.
Four recurring questions, and the distance between the reassuring answer and the acceptable one.
What you receive
The questionnaires already received, the requirements they contain, and what you actually hold as usable evidence for each. This is the document that exposes the distance between what you do and what you can demonstrate.
Each answer tied to its evidence, its owner and the date it was last verified. Written once, reusable for every client, which removes the drift between two questionnaires.
Gaps ranked by what genuinely blocks a sale, not by theoretical severity. A missing control nobody ever asks about comes after a missing record every one of your clients demands.
The review that keeps the file current, and support when a questionnaire arrives on a short deadline. This is the part that stops the library becoming wrong within twelve months.
What gets measured
Time between receiving a questionnaire and sending a complete, internally approved answer.
The proportion of answers backed by current evidence, as opposed to a statement with no document and no date.
Progress on the remediation plan, and how many items remain open from one quarter to the next.
Estimate
Three numbers to measure the time consumed, and what an answer library would give back.
Indicative estimate. A maintained library typically cuts time per questionnaire by 60 to 75% from the second one; the assessment measures your situation.
Pricing
Indicative ranges excluding applicable taxes. The first file costs the most; later ones reuse the library already built.
01
3'000 – 5'000 CHF
Two to three weeks. Your received questionnaires set against the evidence you actually hold.
Request an assessment02
8'000 – 15'000 CHF
One real questionnaire handled end to end, within its deadline, with you.
Request an assessment03
10'000 – 25'000 CHF
Then per month 1'500 – 4'000 CHF
Full library, remediation plan, then periodic review and support.
Request an assessmentNo certification is issued and no acceptance by your client is guaranteed. What is sold is a file backed by evidence, kept current, and defensible under review.
No certification is issued. Acceptance by a client, an auditor or an authority is not guaranteed and cannot be. Independent audits, legal opinions and technical remediation outside the scope are quoted separately. And we do not draft an answer your evidence does not support.
FAQ
Yes, and it is the only sustainable way. The answer states the gap, the owner and the proposed plan. A client accepts an owned gap with a deadline far better than a statement they will later discover to be false.
No. Certenor prepares and maintains your file. Any certification or regulatory assessment belongs to accredited bodies and competent authorities, which we do not claim to be.
Six to ten weeks for the initial build, depending on the number of requirements and the state of your evidence. An urgent questionnaire can be handled in parallel, but it produces a one-off answer, not a library.
No, but you need someone who can decide. Gaps close through resource trade-offs, and those are not technical decisions. Without a counterpart who can settle them, the remediation plan stays a list.
Every answer carries its evidence and its date, which keeps the discussion factual. If the evidence is insufficient, we say so rather than defend it, and the point joins the remediation plan.
Request an assessment
Tell us who is asking, by when, and what usable evidence you already hold. We reply within two working days, in English, French or German.
A questionnaire on your desk and a short deadline? That is the right moment to write to us.
Email Certenor