Hozirda xavfsizlik va GRC jamoalaridagi odamlar butun ish kunini xavfsizlik so'rovnomalariga javob berish bilan o'tkazishmoqda. Ba'zi kompaniyalarda bu to'liq ish o'rni: GRC tahlilchisi yoki muvofiqlik menejeri keladi, noutbukni ochadi va uyga ketguncha bu shakllar bilan ishlaydi — yiliga ikki-uch yuzta. Men bu hikoyalarni eshitganman. Kechki ovqatni o'tkazib yuborish, farzandining o'yinini yarmida qoldirish, dam olish kunini yo'qotish — bularning barchasi kompaniya hali ham zaxira nusxalarini saqlaydimi, deb so'raydigan shakl uchun. Ular buni qilishadi, chunki so'rovnoma daromad yo'lida turadi. Agar shakl to'xtab qolsa, bitim ham u bilan birga to'xtaydi.
Bu jarayonda ikki tomonlama standart mavjud. O'sha so'rovnomalar ostida ko'milgan jamoa o'z navbatida ularni kompaniyaning o'z yetkazib beruvchilariga yuboradi, javoblarni yig'adi va ularni o'sha yetkazib beruvchilar ishonchli ekanligining isboti sifatida saqlaydi. Ular shaklni to'ldirganda javoblar qanchalik kam qiymatga ega ekanligini bilishadi, chunki ular muddat ostida "ha" javoblariga qanchalik kam e'tibor berilishini kuzatishgan. Shunga qaramay, yetkazib beruvchi ularni qaytarib yuborganda ularga tayanishadi, chunki uzoq vaqt davomida tayanish uchun bundan yaxshiroq narsa yo'q edi.
Xuddi shu shakl, yuborilganda ishonchsiz, qabul qilinganda ishonchli
Orqaga qadam tashlang va butun almashinuvni ko'ring. A kompaniyasi B kompaniyasiga sotishni xohlaydi. Bitim yopilishidan oldin B A ga so'rovnoma va imzolash uchun xavfsizlik shartlari to'plamini yuboradi: xavfsizlik qo'shimchasi, ma'lumotlarni qayta ishlash shartnomasi va endi AI qo'shimchasi. A kompaniyasi savollarga javob beradi, majburiyatlarni imzolaydi va bitim davom etadi. Ammo A ham dasturiy ta'minot sotib oladi, shuning uchun u o'z yetkazib beruvchilarini xuddi shu mashqdan o'tkazadi va kimga ishonish kerakligini hal qilish uchun ularning javoblarini baholaydi. A kompaniyasi javob berganda yumshoq ekanligini bilgan shakl, A xaridor tomonida o'tirganda, boshqa birovga ishonish uchun asos bo'ladi. Zanjirdagi har bir kompaniya bir vaqtda ikkalasini ham qiladi.
Yaxshi dasturlar allaqachon so'rovnomaning zaif ekanligini bilishadi, shuning uchun ular SOC 2 hisobotini, ISO sertifikatini, kirish testini va ba'zan tashqi xavfsizlik reytingini ham so'rashadi. Ammo og'irlik hali ham qayerda ekanligiga qarang. So'rovnoma hali ham bitimni ochadigan va ehtiyotkorlik dalili sifatida faylga tushadigan narsadir. Biz uni qo'shimchalar bilan o'rab oldik va uni markazda qoldirdik. Kompaniyalar o'rtasidagi ishonch, biz tan olishni xohlamagan darajada, o'z-o'zini hisobot qilishga — yetkazib beruvchining o'z xavfsizligi haqidagi o'z hisobiga, asosan uning so'ziga ishonishga — tayanadi.
Nima uchun o'z-o'zini hisobot qilgan javob endi dalil emas
Javob nazorat emas. Yetkazib beruvchi "ha" deb yozishi bu narsani haqiqat qilmaydi, va bu sizning o'z jamoangiz rollar almashganda "ha" deb yozgani uchun ham haqiqat emas edi. So'rovnoma niyatni, yoki kimdir uni yozgan kunda to'g'ri bo'lgan sozlamani qamrab oladi, keyin esa hamma oldinga harakat qiladi, muhit esa o'zgarishda davom etadi.
Agar bu model ishlagan bo'lsa, uchinchi tomon buzilishlari kamroq bo'lishi kerak edi. Ular kam emas. Verizonning 2025-yilgi Ma'lumotlar Buzilishi Tadqiqotlari Hisobotiga ko'ra, uchinchi tomon ishtirokidagi buzilishlar ulushi bir yilda ikki baravar oshdi — 15 foizdan 30 foizgacha. Ular arzon ham emas. IBMning 2025-yilgi Ma'lumotlar Buzilishi Xarajatlari hisobotida uchinchi tomon va ta'minot zanjiri buzilishi eng qimmat vektorlardan biri bo'lib, har bir hodisa uchun taxminan 4,9 million dollarni tashkil etdi — bu global o'rtacha ko'rsatkichdan yuqori, umumiy o'rtacha buzilish xarajati besh yilda birinchi marta pasaygan yilda. Shunday qilib, yetkazib beruvchi orqali sodir bo'lgan buzilish umumiy buzilishlar kamayganiga qaramay, tez-tez uchraydi va qimmatligicha qoladi.
Eng aniq misol ham sohada eng ko'p o'rganilgan buzilishlardan biridir. Target 2013-yil sentyabrda To'lov Kartalari Sanoati Ma'lumotlar Xavfsizligi Standartiga (PCI DSS) muvofiq sertifikatlangan edi. O'sha yil dekabrda u 40 million to'lov kartasi buzilishini e'lon qildi. Sertifikat haqiqiy edi. U ham ma'nosiz edi. O'tgan baholash sizga yetkazib beruvchi bir kunda to'siqdan o'tganini aytadi. U sizga yetkazib beruvchi xavfsiz ekanligini aytmaydi, va bu chalkashlik — to'liq sertifikatlangan kompaniyalar hali ham buzilish xabarnomalarini yozishiga sabab bo'ladi.
Va'dalarni almashishni to'xtating, dalillarni almashishni boshlang
Bozor bu masalada harakat qila boshladi, va tartibga soluvchilar ham. 2025-yil oktyabridagi sanoat xatida Nyu-York Moliyaviy Xizmatlar Departamenti (NYDFS) o'z nazorati ostidagi firmalardan nimani kutishini aniqlashtirdi: yetkazib beruvchilarni oldindan tekshiring, ularni vaqt o'tishi bilan xavf asosida qayta baholang, yetkazib beruvchining o'z so'ziga tayanish o'rniga mustaqil audit hisobotlarini oling va muvofiqlikni yetkazib beruvchiga topshirib bo'lmasligini tan oling. Tasdiqlarni almashishni to'xtating va boshqa tomon o'zi yozmaydigan narsalarni almashishni boshlang. Bu qaysi stulda o'tirganingizga bog'liq.
Yetkazib beruvchini baholayotganda, ular siz uchun yozolmaydigan narsadan boshlang. So'rovnoma yuborilishidan oldin, tashqaridan kuzatiladigan narsalarga qarang — bularning hech biri o'z-o'zini hisobot qilmaydi:
- Ochiq infratuzilma va ularning ommaviy tizimlarining holati
- Buzilish va hodisalar tarixi
- Sizib chiqqan yoki ochiq qolgan ma'lumotlar
Bu mukammal emas. Xavfsizlik reytinglaridan foydalangan har kim shovqinni, eskirgan IP manzilni, hech qachon ularga tegishli bo'lmagan subdomenni biladi. Ammo bu o'z-o'zini baholagan shaklga qaraganda bezash qiyinroq, va bu yetkazib beruvchining o'z hisobidan yaxshiroq boshlang'ich nuqtadir. U yerdan haqiqiy sa'y-harakatlaringizni sizning ma'lumotlaringiz yoki kirish huquqingiz yetarlicha zarar yetkazishi mumkin bo'lgan bir nechta yetkazib beruvchilarga qaratib, qolganlardan esa nasr emas, dalil so'rang: hisobot, test natijasi yoki sotuv jamoasida bo'lmagan kimdir imzolagan tasdiq.
Baholanayotgan tomon bo'lganingizda, xuddi shu tamoyil amal qiladi. Shartnomalaringizdagi xavfsizlik va ma'lumotlarni qayta ishlash shartlari so'rovnomaga qaraganda aniq va majburiydir, va mijoz sizdan ko'rsatishni, tasdiqlashni emas, so'rash huquqiga ega. Amalda bu quyidagilarni anglatadi:
- "Bu band nima talab qilayotganini bajarayotganingizni ko'rsating" degan savolga joriy dalil bilan javob bera olish
- O'sha dalilni har bir mijozning shakliga uch yuzta javobni qayta yozish o'rniga, talab bo'yicha taqdim eta olish
- So'zlarni haqiqatan ham ishlayotgan narsaning aniq tavsifi sifatida, kimdir oxirgi marta yozganida to'g'ri bo'lgan narsa emas, deb tasdiqlay olish
Siz va'dalarni yozma ravishda berasiz. Ularni xuddi shu tarzda qo'llab-quvvatlay oling.
Ikki kompaniya o'rtasidagi ishonch nimaga tayanishi kerak
So'rovnoma siz ichkariga kira olmaydigan yetkazib beruvchini baholashning boshqa yo'li bo'lmaganida ma'noga ega edi. Har kimga shakl yuborish ko'r-ko'rona uchishdan yaxshiroq edi. Bu cheklov yo'qoldi. Siz kompaniyani tashqaridan kuzata olasiz va o'z majburiyatlaringiz ortida haqiqiy dalil ishlab chiqa olasiz — bularning hech biri o'n yil oldin keng miqyosda mavjud emas edi.
Shunday ekan, o'z-o'zini hisobot qilish qaror qabul qilishga yo'l qo'ymang. Agar u suhbatni boshlashga yordam bersa, so'rovnomani saqlang, lekin dalilni — sizning va ularning — haqiqatan ham ishonch bor-yo'qligini hal qiladigan narsa qiling. Kompaniyalar bir-birining so'ziga ishonib hech qachon xavfsiz bo'lmagan. Uzoq vaqt davomida bu yagona variant edi. Endi u emas.
Right now, people on security and GRC teams are spending their entire workday answering security questionnaires. At some companies it is a full-time role: a GRC analyst or compliance manager who arrives, opens a laptop, and works through these forms until they go home, two or three hundred of them in a year. I’ve heard the stories. The dinner missed, left a kid’s game at halftime, lost the weekend to a form asking whether the company still keeps tape backups. They do it because the questionnaire sits on the path to revenue. If the form stalls, the deal stalls with it.
There is a double standard built into the process. The same team buried under those questionnaires also sends them out to the company’s own vendors, collects the answers, and files them as proof those vendors are safe to trust. They know how little the answers are worth when they fill them out, because they have watched how little scrutiny the yeses get under deadline. They rely on them anyway when a vendor sends them back, because for a long time there was nothing better to rely on.
The same form, distrusted going out and trusted coming in
Step back and look at the whole exchange. Company A wants to sell to Company B. Before the deal closes, B sends A a questionnaire and a stack of security terms to sign: a security addendum, a data processing agreement, and now an AI addendum. Company A answers the questions, signs the commitments, and the deal proceeds. But A buys software too, so it runs its own vendors through the same exercise and weighs their answers to decide whom to trust. The form Company A knew was soft when it answered becomes, when A sits on the buyer’s side, its basis for trusting someone else. Every company in the chain is doing both at once.
Good programs already know the questionnaire is weak, which is why they also ask for a SOC 2 report, an ISO certificate, a penetration test, and sometimes an outside security rating. But look at where the weight still sits. The questionnaire is still what gates the deal and lands in the file as the record of due diligence. We have surrounded it with supplements and left it at the center. Trust between businesses runs, more than we like to admit, on a self-report: a vendor’s own account of its security, taken largely on the vendor’s word.
Why a self-reported answer stopped being evidence
An answer is not a control. A vendor writing yes does not make the thing true, and it was not true because your own team wrote yes when the roles were reversed. A questionnaire captures an intention, or a setting that was accurate on the day someone typed it, and then everyone moves on while the environment keeps changing.
If this model were working, third-party breaches should be getting rarer. They are not. Verizon’s 2025 Data Breach Investigations Report found the share of breaches involving a third party doubled in a single year, from 15 percent to 30 percent. They are not cheap, either. In IBM’s 2025 Cost of a Data Breach report, third-party and supply-chain compromise was one of the most expensive vectors at roughly $4.9 million per incident, above the global average, in a year when the overall average breach cost fell for the first time in five years. So the vendor-borne breach is getting more common and staying more costly even as breaches overall ease.
The clearest illustration is also one of the most studied breaches in the industry. Target was certified compliant with the Payment Card Industry Data Security Standard in September 2013. That December it disclosed a breach of 40 million payment cards. The certificate was real. It was also beside the point. A passing assessment tells you a vendor cleared a bar in one day. It does not tell you the vendor is secure, and that conflation is how thoroughly certified companies still end up writing breach notifications.
Stop trading promises, start trading proof
The market has started to act on this, and so have regulators. In an October 2025 industry letter, the New York Department of Financial Services (NYDFS) clarified what it expects of the firms it oversees: vet vendors up front, reassess them on a risk basis over time, obtain independent audit reports rather than rely on a vendor’s own say-so, and recognize that compliance cannot be handed off to the vendor. Stop exchanging assertions and start exchanging things the other party does not get to author. What that looks like depends on which chair you are in.
When you are assessing a vendor, start with what they cannot write for you. Before the questionnaire goes out, look at what is observable from the outside, none of which is self-reported:
- Exposed infrastructure and the state of their public-facing systems
- Breach and incident history
- Leaked or exposed credentials
It is not perfect. Anyone who has used security ratings knows the noise, the stale IP address, the subdomain that was never theirs. But it is harder to dress up than a self-graded form, and it is a better starting point than the vendor’s own account of itself. From there, concentrate your real effort on the few vendors who hold enough of your data or access to cause meaningful damage, and ask the rest for proof rather than prose: a report, a test result, or an attestation signed by someone who is not on the sales team.
When you are the one being assessed, the same principle holds. The security and data processing terms in your contracts are specific and binding in a way the questionnaire is not, and a customer is entitled to ask you to show, not assert, that you are meeting them. In practice that means being able to:
- Answer “show me you are doing what this clause requires” with current evidence
- Produce that evidence on demand, rather than re-typing the same three hundred answers into every customer’s form
- Stand behind the words as an accurate description of what is actually running, not what was true when someone last typed them
You put the promises in writing. Be able to back them the same way.
What trust between two companies should rest on
The questionnaire made sense when there was no other way to size up a vendor you couldn’t see inside. Mailing everyone a form was better than flying blind. That constraint is gone. You can observe a company from the outside, and you can produce real evidence behind your own commitments, neither of which existed at scale a decade ago.
So stop letting a self-report be the decision. Keep the questionnaire if it helps you start a conversation, but make the evidence, yours and theirs, the thing that actually settles whether there is trust. Businesses were never safe taking each other’s word for it. For a long time that was the only option. It is not anymore.