Your Vendor Questionnaire Now Asks Who's Certified, Not Just What You Bought
October 8, 2026
Ric Hall, CRO— AI-assisted and reviewed prior to publication.
A vendor security questionnaire now asks who on your team holds a current governance, risk, or cloud security certification, not just which tools sit on your network. Regulators overseeing banks, insurers, and defense contractors have spent the past two years telling supervised firms to verify a vendor's staff competence directly, and procurement teams are now the ones asking the question.
Why Do Vendor Risk Questionnaires Ask About Staff Certifications Now?
Because the regulators standing behind the customer told them to. The New York Department of Financial Services said in its October 2025 guidance that independent third-party assessments or certifications, such as SOC 2 or ISO 27001, should be reviewed and required where feasible when regulated entities evaluate service providers. That guidance does not stop at organizational certificates. It sits inside a broader supervisory expectation that examiners can trace who actually did the security work, not just which framework a vendor claims to follow.
Banking regulators set the same expectation earlier. The joint guidance from the Federal Reserve, FDIC, and OCC directs banks to build third-party risk management practices that account for the level of risk, complexity, and criticality of each vendor relationship across the full life of that relationship. A bank examiner reviewing a vendor file wants evidence that due diligence happened and kept happening, and a staff certification with a verifiable ID and renewal date is far easier to defend under audit than a resume claim or a sales deck.
What Changed in 2025 to Push Certifications Into Procurement?
Three separate regulatory tracks converged this year, and each one raises the documentation bar for vendors serving a regulated customer. None of the three ask for a certificate on a wall. All three ask for a current, checkable record tied to a named person.
In the defense sector, the Cybersecurity Maturity Model Certification program moved from proposal to contract clause. Contractors handling federal contract information or controlled unclassified information must now obtain certifications confirming they meet the underlying cybersecurity requirements that have applied to defense contracts for years, and the rule gives the Defense Contract Management Agency authority to verify assessments and pull certification if corrective actions lapse. A prime contractor evaluating a subcontractor now has a direct compliance reason to ask who on that subcontractor's team actually understands the control set, not just whether the company bought a compliance product.
In the European Union, the Digital Operational Resilience Act put a personal accountability clause into the regulation itself. Article 5(4) requires that members of a financial entity's management body maintain enough knowledge to understand and assess ICT risk, and the European Insurance and Occupational Pensions Authority's DORA overview confirms the regulation establishes an EU-wide oversight framework specifically for the ICT third parties that financial entities depend on. A financial entity building its DORA-mandated register of information has to describe the vendor's risk posture in granular detail, and staff certification is one of the few data points that survives a supervisory challenge.
Add to that a shift in vendor behavior itself. Industry survey data cited in a review of third-party risk management certification trends found that 57% of organizations now choose to remediate identified vendor risks rather than simply document and accept them, up sharply from 17% two years earlier. Remediation requires someone qualified to fix the problem, and questionnaires are starting to ask for that person's name.
Which Certifications Actually Satisfy a Third-Party Risk Reviewer?
It depends on what the vendor relationship touches, and reviewers are getting more specific about matching the certification to the exposure. A cloud services vendor gets asked about cloud security credentials. A vendor handling governance documentation for a regulated client gets asked about GRC credentials. A table helps here because the mapping is not one-size-fits-all.
| Vendor risk domain | Certification a reviewer looks for | What it demonstrates |
|---|---|---|
| Governance, audit trail, control mapping | ISC2 CGRC | Staff can build and maintain the control documentation an auditor will pull |
| Cloud infrastructure and data hosting | ISC2 CCSP | Staff understands cloud-specific data protection and shared responsibility |
| Enterprise risk and IT audit | ISACA CISA or CRISC | Staff can assess and report control effectiveness in terms an examiner accepts |
| Security operations under a managed contract | CompTIA CySA+ | Staff can detect and respond to incidents affecting the client's data |
None of these substitute for a SOC 2 report or an ISO 27001 certificate at the organizational level. They answer a different question: whether the specific people doing the work for that client actually know the material, which is exactly the gap a corporate certificate cannot close on its own.
What Happens If You Can't Document Certified Staff?
You lose the deal, or you lose the renewal, before anyone discusses price. A vendor that cannot answer a staff certification question with names, credential IDs, and renewal dates gets flagged in the questionnaire tier that triggers deeper review, and deeper review adds weeks to a sales cycle that the buyer's compliance team controls, not yours. Under frameworks like DORA and the interagency banking guidance, that flag is not discretionary. The buyer's own examiner will ask about it later.
The cost compounds for vendors serving multiple regulated sectors at once. A managed service provider selling into banking, defense, and insurance clients simultaneously now needs staff who can produce three different flavors of the same underlying evidence, because NYDFS, DORA, and CMMC each frame the requirement slightly differently even though they are all asking the same practical question: who is accountable for this control, and can you prove it.
How Do You Build an Audit-Ready Certification Record?
Start with a roster, not a training plan. Every named individual working on a regulated account should have a certification that maps to the specific work they perform, a renewal date tracked somewhere the sales and compliance teams both check, and a credential ID that a customer's auditor can verify independently. That last part matters more than most vendors expect. A certification a customer cannot verify is functionally the same as no certification during an audit.
If you are the one holding certifications rather than reviewing them, the sequence works the same way in reverse. Map your current role, or the role you want, to the credential that a procurement reviewer in your target industry is actually asking about, then build toward it with a plan rather than a deadline scramble. A curriculum overview built around exam objectives is a reasonable place to start that mapping before committing to a specific track, since not every governance credential covers the same ground and picking the wrong one wastes months. For staff whose job touches audit evidence, control documentation, and vendor risk reporting directly, the ISC2 CGRC certification lines up closely with what the NYDFS and interagency guidance are actually asking vendors to prove.
None of this is optional anymore for a vendor serving a regulated customer, and it is not going to loosen. Examiners write guidance once and then expect firms to enforce it downstream through contracts, which is exactly how a New York banking regulation ends up shaping a hiring decision at a managed service provider three states away. If your team needs a study plan built around a specific governance or cloud security track before your next renewal cycle, you can start training now rather than after the questionnaire lands.
The vendors who treat certification as a documentation exercise, something to produce when asked, will keep losing time to review cycles. The ones who treat it as a standing roster, updated before the renewal date rather than after the question arrives, will clear due diligence faster and keep the contracts that depend on it.