Pharma and biotech buyers rarely wait until the ink is dry to ask how you run IT. The security questionnaire often lands before the SOW, sometimes before the kick-off call. For growing life-sciences SMEs on Cambridge Science Park, Granta Park and across the cluster, that pack is not a formality. It is a gate.

You can treat it as a scramble every time a BD lead forwards a spreadsheet. Or you can keep a calm, evidence-backed pack that your ops lead updates once a quarter. The second option wins contracts. The first burns weeks you do not have.

Why supplier questionnaires show up before the contract

Large customers and CROs carry their own audit risk. If your laptop loses a shared dataset, or a contractor account stays live after a project ends, their security team owns the fallout. So they ask early: MFA, patching, backups, access control, incident response, and who actually runs the estate.

For science-park firms, this usually arrives when you move from pilot work into a paid collaboration, when a pharma vendor portal opens, or when a funding partner wants supply-chain assurance. It is the same pattern as Cyber Essentials in a tender pack, only more specific to how you operate.

The questionnaire is not an insult to a thirty-person company. It is how buyers check that “we take security seriously” means something you can show.

What buyers actually ask (MFA, patching, backups, access, policies — plain English)

Most life sciences supplier security questionnaires circle the same themes. The wording changes. The intent does not.

MFA. Is multi-factor authentication on for email, cloud file stores, admin portals and any SaaS that holds company or customer data? Buyers increasingly care which MFA you use. SMS codes are weaker than app-based or phishing-resistant methods. If you are still on text for Microsoft 365, that answer is already under pressure. See our note on Microsoft SMS MFA retirement for Cambridge life sciences.

Patching. How quickly do you apply critical OS and firmware updates? A monthly “when someone remembers” habit fails modern Cyber Essentials marking and looks weak on a pharma vendor security questionnaire UK buyers reuse across suppliers. Fourteen days for high and critical fixes is the bar many packs now assume. Our Cyber Essentials Danzell checklist covers why that clock matters.

Backups. What is backed up, how often, where it sits, and when you last restored a file for real? “We have OneDrive” is not a backup strategy if nobody has tested recovery.

Access. Who has admin rights? How do joiners and leavers get handled? Are shared passwords banned? Can a contractor still open SharePoint from last year’s collaboration?

Policies and ownership. Do you have written acceptable use, incident response and data handling notes that match how people work? Who is accountable when something goes wrong? Buyers want a named owner, not a shrug toward “IT”.

Answer in plain English. If a control is partial, say so and say what you are doing next. Invented certainty ages badly when the follow-up call asks for a screenshot.

Evidence that travels: screenshots, policies, certificates vs hope

Procurement teams have seen every confident sentence. What moves a questionnaire from “pending” to “approved” is evidence that travels without you on the call.

Useful pack items usually include:

• MFA policy screenshots or admin reports for Microsoft 365 and other in-scope cloud apps
• Patch compliance reports or managed endpoint summaries with dates
• Backup configuration and a short restore test note (who ran it, what was restored, when)
• Joiner/leaver checklist and a recent access review for privileged accounts
• Current policies with version dates, not undated Word drafts
• Certificates where you hold them (for example Cyber Essentials), plus the scope statement

Hope is “we turn MFA on for everyone next month”. Evidence is “MFA enforced for all users as of [date]; SMS retired for admins; screenshot attached”.

Keep originals in a controlled folder your ops lead and MSP can both reach. Redact where you must. Do not paste live secrets into the buyer’s portal.

Shared science-park offices and CROs: how to answer without over-claiming

Cambridge-cluster life sciences firms often share buildings, meeting rooms, lab services and CRO partners. That makes scope tricky. Buyers ask about physical security, Wi-Fi, visitors and who can touch which systems. Over-claiming here is worse than a careful “partial”.

Be precise about what you control. Your Microsoft 365 tenant, company laptops, identity, backups and SaaS stack are yours. Building Wi-Fi, shared reception systems and landlord CCTV usually are not. Say what the landlord or park provides, what your lease or facilities pack covers, and where your policies start.

For CRO and collaborator access, describe the model you actually use: guest accounts with expiry, separate SharePoint sites, no shared mailboxes for client data, MFA required for external users where the platform allows it. If a partner brings their own devices into a shared lab, say how you isolate company data rather than pretending every desk is a fortress.

Cambridge science park cyber compliance questions reward honesty about shared estates. Assessors and security reviewers expect nuance. They do not expect a micro-SME to own the whole park’s network.

A calm prep pack your ops lead can keep current

Build the pack once. Refresh it on a calendar, not when BD panics.

A practical folder structure:

1. Identity and MFA — current methods, enforcement status, privileged account list
2. Devices and patching — asset inventory, OS versions, patch SLA, unsupported kit plan
3. Backups and recovery — scope, frequency, last restore test
4. Access and leavers — process, last review date, third-party accounts
5. Policies — acceptable use, incident response, data classification or handling notes
6. Certificates and insurance — Cyber Essentials (if held), cyber insurance summary if buyers ask
7. Network and premises — what you control vs landlord or park facilities
8. Contacts — who answers questionnaires, who can pull screenshots within 48 hours

Assign one ops owner. Give your managed IT partner a standing brief to keep the technical evidence fresh. Review after any major change: new SaaS, new lab site, new admin, or a failed restore test.

This is regulated SME IT due diligence you can reuse across buyers. Rewrite the covering note each time. Do not rebuild the evidence from memory.

When “we’ll figure it out later” costs a quarter

Delayed questionnaires do not sit politely in a tray. Deals slip. Kick-offs move. Finance notices the revenue that stayed in “probable”.

The expensive pattern is familiar on the parks: BD promises a two-week turnaround, IT discovers MFA gaps and three cloud apps nobody listed, someone drafts answers overnight, and the buyer comes back with follow-ups you cannot evidence. A fortnight becomes six weeks. The collaboration that needed Q4 start lands in the next financial year.

Worse is shipping answers you cannot defend. If a later audit or incident shows the controls were theatre, trust with that customer is hard to rebuild. For life-sciences firms chasing repeat pharma work, that reputational hit outlasts one delayed SOW.

Prep is cheaper than heroics. A current pack turns a supplier questionnaire into a copy-and-attach job with a short human review, not a mini-programme every time.

For ongoing control ownership and evidence refresh, see our managed IT page, or cyber security when the gap is specific.

How CAMBITION helps

CAMBITION is a Cambridge MSP founded in 2012. We support 250+ clients, with deep day-to-day work in life sciences and other regulated SMEs across the cluster. Managed IT, Microsoft 365, cyber and compliance facilitation sit under one local team, which is exactly what questionnaire readiness needs: controls that are true, plus evidence you can send without inventing a story.

A short fit call is enough to review where you stand. We look at MFA, patching, backups, access and the gaps a typical life sciences supplier security questionnaire will hit. Where managed IT should own the ongoing care, we say so. Where cyber or compliance facilitation closes a specific hole, we keep that scoped rather than selling a catalogue.

If you want questionnaire-readiness checked before the next portal login lands in someone’s inbox, call 01223 656 156 or use our /contact/ page. Bring the last pack you struggled with if you have one. We will tell you what would travel today and what would stall a buyer.

Frequently asked questions

Why do life-sciences buyers send IT security questionnaires before the contract?

Pharma, biotech and CRO customers carry audit risk if a supplier mishandles data or access. Questionnaires check MFA, patching, backups, access control and ownership before paid work starts.

What evidence should a science-park SME keep ready?

MFA enforcement screenshots, patch reports, backup and restore-test notes, joiner/leaver process, dated policies, and any certificates such as Cyber Essentials with scope stated.

How should shared offices and CROs be described?

Be precise about what you control versus landlord or park facilities. Describe guest access, expiry and MFA for collaborators without claiming you own the whole building network.