Your biggest customer sends a security questionnaire, and the insurer wants to see something too.
Major customers have to assess their suppliers, under NIS2, DORA and their own policies, so the questionnaires come: forty pages on access, backups, incidents and suppliers, with a deadline and sometimes a contract depending on it. At the same time the cyber insurer wants to see MFA, backups and an incident plan at renewal. Within two days you'll have an experienced security officer or GRC specialist interviewed who answers it, closes the gaps and records it so the next questionnaire takes days instead of weeks. If you need someone permanently, we recruit that person just as well, though not within two days.
The moment
It arrives via the account manager: a spreadsheet or a portal from your biggest customer, with hundreds of questions about how you manage access, test backups, report incidents and assess your own suppliers, to be completed within three weeks. Sometimes a contract renewal depends on it, sometimes your admission as a supplier. The IT manager recognises half the questions; the other half is about policies that aren't on paper. And in the same month the cyber insurer asks at renewal for evidence of MFA, tested backups and an incident plan, or the premium goes up or the cover comes off. Two questions from two directions, with the same answer: there has to be someone who can answer this and make it true.
Why the questionnaires won't stop
Large organisations have to assess their supply chain. The Dutch Cybersecurity Act and DORA require them to manage supplier risks and record agreements, and their own customers and regulators ask for evidence of that. They get that evidence from you, and the questionnaire gets longer and stricter every year. Those who answer the first one well and record the answers have half a day's work on the second; those who start over each time lose a week per customer and one day a contract. Insurers do the same with their own list of basic controls. Both are actually a gift: a concrete list of what needs to be in order, from someone who means it.
What needs to happen now
- This questionnaire on time and honestly. Answer what's true, and for what isn't, a plan with a date; customers accept that more often than a cleaned-up truth. A security officer or GRC officer, in the first week.
- Closing the gaps. Usually MFA, testing backups, access reviews, an incident plan and agreements with your own suppliers. A security engineer who does it, alongside your own administrators.
- One set of answers and evidence. A policy set and a folder of evidence reused for every customer and insurer. The GRC officer, so the next questionnaire isn't a project.
- Your own suppliers. Whoever asks you the questions expects you to ask them of your suppliers too. A third-party risk specialist sets that up.
- Deciding on certification. If every customer starts asking for ISO 27001 or SOC 2, at some point a certificate is cheaper than ten questionnaires. The interim professional has that conversation with management.
Who leads this
Organisations here look for a security officer or GRC officer who answers the questionnaires and builds the evidence, a security engineer who implements the basic controls, and in larger supply chains a third-party risk specialist. Which of those roles it is for you depends on how many customers are asking and what's already in place; that's where the intake starts. If you need someone permanently, that's simply permanent recruitment; temporarily, it's interim. We've been doing both for years.
Interim: within two days, and what it costs
Fast doesn't mean sloppy. We start with a proper intake: who's asking, what they're asking, when it has to be back, what's already in place. Then we search a network of interim professionals we have usually known for years, which is how, for an interim assignment, you'll have your first candidate interviewed within two days. If you need someone permanently, it works differently and takes longer. The best permanent candidates are rarely actively looking: they're settled somewhere and only move for the right arguments, from someone who knows them and what drives them. That is exactly our work, and it produces the best match, but not within two days. Interim professionals are entrepreneurs: more commercial, more flexible in both directions, and therefore faster to propose from the network we actively maintain. If we don't have someone who truly fits, we'll say so. You always see the professional's rate and our margin separately, and that margin is never more than €15 per hour on a full-time assignment; for a part-time assignment, which this often is, the margin per hour may be higher, and you see that up front too. You can contract the freelancer directly or through your own broker, in which case we invoice only our margin, or entirely through Gruzzy with a single invoice. Who is available right now, and in which rate band, is listed anonymously with the available interim professionals.
Freelance, and the Dutch DBA Act
Answering a questionnaire, closing the gaps and building a reusable evidence set is an assignment with a clear beginning and end: there's a result, the professional decides how the work gets done, and there's no employer-style line of authority. That is what the Dutch tax authority wants to see now that enforcement on false self-employment has resumed since 2025, so freelance fits well here, with a model agreement. If it turns out the questions come back every quarter and someone is needed structurally, we'll say so. Usually that's a permanent role through recruitment; if you really want someone temporarily on payroll, secondment is possible, although it isn't our core business. We're happy to advise on this before you sign.
Call today?.
Call us, or book a slot yourself. Within fifteen minutes you'll know whether we can help and who the right person is.
Call: 020 399 1●●●
Available for interim now.
A selection of the interim professionals who can start right now. Anonymous until you get in touch; rate and availability are listed.
NIS2 / Cyberbeveiligingswet · DORA · SOX (ITGC)
- interim · €95k–100k gross per year
ISO 27001 · ISO 27002 · NIS2 / Cyberbeveiligingswet
- Interim / Freelance · €120–130 per hour
ISO 27001 · NIS2 / Cyberbeveiligingswet · AVG/GDPR
- Arnhem-Nijmegen
- interim / freelance · €120–130 per hour
Frequently asked questions.
Can someone fill in our customer's questionnaire?
Yes, and preferably someone who has done it before, because the first questionnaire is the slowest. A security officer or GRC officer answers it together with you, records the answers and the evidence so the next questionnaire takes days instead of weeks, and immediately sees where the real gaps are. Answering honestly with a plan for what isn't right yet works better with customers than a cleaned-up truth.
How fast can you provide someone?
For interim: within two days you'll have your first candidate interviewed; for a permanent role it takes longer, because the best candidates are rarely actively looking and have to be moved with the right arguments; we discuss what's realistic at the intake. We start with an intake about who's asking the questions, when it has to be back and what's already in place, then search a network of interim professionals we have usually known for years. If we don't have anyone who truly fits, we'll say so.
Why are customers suddenly asking so many security questions?
Because they have to. The Dutch Cybersecurity Act and DORA require large organisations to manage risks at their suppliers and record agreements, and their own customers and regulators ask for evidence of that. They get that evidence from you. The lists get longer and stricter every year, so whoever builds a reusable set of answers now is done quickly next time.
The cyber insurer sets requirements at renewal. Is that the same work?
Largely. Insurers ask for the same basic controls as customers: MFA, tested backups, access management, an incident plan, sometimes detection. A security engineer who closes the gaps and a security officer who records the evidence serve both at once. Tell us at the intake exactly what the insurer asks and we'll take it along.
Freelance, secondment or permanent: what suits this?
Answering a questionnaire, closing the gaps and building an evidence set is an assignment with a clear beginning and end, and then a freelancer with a model agreement fits well. If it turns out the questions come back every quarter and someone is needed structurally, we'll say so and recruit that person permanently. If you really want someone temporarily on payroll, secondment is possible, although it isn't our core business.
What does this cost?
That depends on the person and the scope, and you always see the professional's rate separately from our margin. That margin is never more than €15 per hour on a full-time assignment; for a part-time assignment, which this often is, the margin per hour may be higher. You see that up front, just like the rate.
Do we then also have to assess our own suppliers?
Whoever asks you the questions usually expects you to ask them of your suppliers too; that's what supply-chain security means. A third-party risk specialist sets up a light, workable assessment that fits your size, so you can answer that question with yes next time.
Isn't an ISO 27001 certificate easier than all those questionnaires?
At some point, yes. If every major customer starts asking for ISO 27001 or SOC 2, a certificate is cheaper than ten questionnaires a year, and many customers accept the certificate instead of their own list. The interim professional has that conversation with management; if it becomes a certification programme, also see our page on ISO 27001.
A questionnaire with a deadline on the mat?
Tell us who's sending it and when it has to be back. If you need an interim professional, your first candidate is interviewed within two days — and if we don't have anyone who fits, we'll say so.