Assessing a provider's cybersecurity: certification, scored assessment, questionnaire, what each one proves

In brief: when you entrust identities, supporting documents and banking data to a provider, you inherit its level of security. Three types of proof circulate to establish it, and they do not say the same thing at all. A certification such as ISO 27001 attests that a management system has been audited, but gives no measure of level and depends entirely on its scope. A scored assessment such as CyberVadis produces a score out of 1,000 and granularity by domain, but it is not a certification audit. A self-declared questionnaire, for its part, proves nothing on its own. The useful reflex is not to collect logos, it is to ask six precise questions.

‍

Why your provider's security is your problem

‍

The reasoning has become commonplace but it remains accurate: a poorly protected provider becomes your weak point. If your identity verification supplier suffers a leak, it is your customers' identity documents that circulate, not its own.

‍

Three frameworks turn this observation into an obligation.

‍

GDPR, which makes the processor a link in the chain that the controller must make sure offers sufficient guarantees. The contract is not enough: you have to be able to show what that assurance rests on.

‍

DORA, for the financial sector and its suppliers, which requires IT service providers to be framed contractually and monitored, in particular those supporting critical functions. Our article on digital operational resilience details what that covers.

‍

The duty of vigilance and, more broadly, knowing your suppliers, which follows the same logic as Know Your Supplier: verify before trusting, then keep verifying.

‍

In all three cases, the buyer has to produce proof. What remains is knowing which one, and what it is worth.

‍

The 3 families of proof, and what they establish

‍

Certification

‍

A certification such as ISO 27001 attests that an independent body has audited an information security management system and judged it compliant with the standard. It is strong proof, because it is external and because it is re-verified periodically.

‍

It has two limits that are often forgotten.

‍

It is binary. A company is certified or it is not. The certification does not say whether it is excellent or only just compliant, nor where its weak points are.

‍

It depends on its scope. The certificate includes a scope statement, and that scope can be narrow: a single site, a single subsidiary, a single service. A provider can present a perfectly genuine certificate that does not cover the product you are buying. This is the most worthwhile check to make, and the most rarely made.

‍

The scored assessment

‍

A scored assessment, such as the one carried out by CyberVadis, produces a numerical score and a breakdown by domain. The method is organised around four functions: Identify, Protect, Detect, React. Identify risks and assets, protect them, detect incidents, be able to react to them. Each function is scored separately, then weighted into an overall score out of 1,000, together with a maturity level ranging from insufficient to mature.

‍

Its value is exactly the opposite of that of certification: it is granular and comparable. It tells you not only that a provider is serious, but where it is less so. You can compare two suppliers on the same scale, which a certification does not allow.

‍

Since 1 January 2026, the CyberVadis medal scale is as follows:

‍

• Platinum: 950 to 1,000
• Gold: 900 to 949
• Silver: 800 to 899
• Bronze: 700 to 799

‍

Below 700, there is no medal, only a participation statement. A provider that highlights a simple participation badge is therefore not communicating a result, it is communicating the fact of having answered.

‍

Its limit is symmetrical: it is not a certification audit in the ISO sense. A scored assessment measures a maturity that is declared and then verified against documents, and the quality of the result depends on the evidence provided. It complements a certification, it does not replace it.

‍

The self-declared questionnaire

‍

This is the document your provider fills in itself, often a 200-line spreadsheet. It has a real use: asking questions specific to your context that neither a standard nor a generic assessment covers.

‍

But it proves nothing on its own. A self-declared questionnaire with no supporting document attached to each answer is a nicely formatted statement of intent. Its value rests entirely on the appended documents: security policy, penetration test report, continuity plan, hosting diagram, list of subprocessors.

‍

Certification or assessment: how to read them properly

‍

The question is not which one to choose. The two answer different questions, and an informed buyer uses both.

‍

• Certification answers "is this provider structured?" It proves the existence of a managed, documented and audited approach. It ranks nothing.
• The scored assessment answers "at what level, and on what?" It ranks and allows comparison. It does not have the normative value of a certificate.
• The questionnaire answers "and for my specific case?" It covers your specifics. It brings no external guarantee.

‍

The reflex to avoid is the most widespread one: treating these proofs as interchangeable logos to tick in a supplier table. A logo cannot be read, a scope and a score can.

‍

The 6 questions to ask before signing

‍

They fit in a few lines and they clear away most of the vagueness.

‍

1. What is the exact scope of the certification? Ask for the certificate itself, not the logo. Check that the service you are buying appears on it, and not only the parent company.

‍

2. How old is the proof, and which version of the standard does it cover? An up-to-date ISO 27001 certification covers the 2022 version. A cybersecurity assessment that is 3 years old says nothing about the current state.

‍

3. Where is the data hosted, and under which jurisdiction? The physical location and the law applicable to the host are two distinct questions, and both matter.

‍

4. What is the subcontracting chain? Your provider itself relies on third parties. Ask for the list, and for what is entrusted to them. That is where scopes get lost.

‍

5. What is the incident notification process? Within what time are you informed, through which channel, with what level of detail? A quantified contractual commitment is worth more than an intention.

‍

6. What does the score breakdown show, not just the score? On a scored assessment, a flattering overall score can mask a weak function. The ability to react is often the least well resourced.

‍

This approach is no different from a risk-based approach applied to your suppliers: the intensity of the control is calibrated on the sensitivity of what you entrust to them. A tool that handles identity documents and banking data does not call for the same level of requirement as an expense report management tool.

‍

Where Meelo stands

‍

Applying to ourselves what we ask of others means giving verifiable elements rather than a speech.

‍

Meelo scored 930 out of 1,000 in its CyberVadis assessment, which corresponds to the Gold medal. This assessment covers the four functions described above: risk identification, protection, detection and reaction.

‍

It is a score awarded by a third party, and that is precisely what we were looking for: an external measure rather than an internal claim. We prefer to call it what it is, a scored assessment, and not a certification, because the confusion between the two is exactly what this article seeks to dispel.

‍

On the rest, the elements are as follows: the data is hosted in France, encrypted, access is controlled, and every identity, fraud or creditworthiness verification decision is logged and auditable. The ISO 27701 certification process, the extension of ISO 27001 dedicated to personal data protection, is under way. We chose this standard rather than another because it covers what our processing actually handles: identities, supporting documents and personal data.

‍

In conclusion

‍

A provider's security is not demonstrated by a logo, and is not verified by ticking a box. A certification proves that an approach exists and has been audited, without saying at what level. A scored assessment states the level and breaks it down by domain, without carrying the weight of a certificate. A questionnaire covers your specifics and proves nothing on its own.

‍

The three complement each other, and none of them excuses you from reading the scope, the date and the detail. If you were to remember only one question from this article, remember the first: ask for the certificate, not the logo.

‍

FAQ

‍

What is the difference between an ISO 27001 certification and a CyberVadis assessment?

‍

ISO 27001 certification is issued by an accredited body after an audit, and it is binary: the company is compliant or it is not, on a declared scope. A CyberVadis assessment produces a score out of 1,000 and a breakdown by domain, which makes it possible to measure a level and to compare providers with one another. The first has normative reach, the second comparative reach. They complement each other.

‍

What does a CyberVadis score of 930 out of 1,000 mean?

‍

It corresponds to the Gold medal, whose band runs from 900 to 949 since 1 January 2026. Above it sits Platinum, from 950. Below, Silver from 800 and Bronze from 700. Under 700, no medal is awarded.

‍

What are the 4 functions assessed by CyberVadis?

‍

Identify, Protect, Detect and React: identifying risks and assets, protecting them, detecting incidents and the ability to react to them. Each function receives its own score, then the whole is weighted into an overall score out of 1,000 together with a maturity level.

‍

Does an ISO 27001 certificate cover the whole company?

‍

Not necessarily, and this is the point most often overlooked. Every certificate includes a scope statement that can be limited to one site, one subsidiary or one service. You therefore need to check that the product you are buying does fall within that scope, by asking for the certificate and not the logo.

‍

Is a supplier security questionnaire enough?

‍

No, not on its own. It is useful for covering your own requirements, which generic frameworks do not address, but its answers are self-declared. Its value depends on the attachments: security policy, penetration test report, continuity plan, hosting diagram, list of subprocessors.

‍

What does DORA require on provider security?

‍

DORA requires financial entities to frame contractually and monitor their IT service providers, with reinforced requirements for those supporting critical or important functions. The obligation covers control of third-party risk, which means documenting the proof on which the trust granted rests.

‍

Is Meelo ISO 27001 certified?

‍

No. Meelo scored 930 out of 1,000 in its CyberVadis assessment, that is the Gold medal, which is a scored assessment by a third party and not a certification. The ISO 27701 certification process, the extension of ISO 27001 devoted to personal data protection, is under way. The data is hosted in France, encrypted, access is controlled, and every decision is logged and auditable.

‍

Sources: CyberVadis documentation on the rating scale, badges and medals; ISO/IEC 27001:2022 and ISO/IEC 27701, International Organization for Standardization; Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA); the General Data Protection Regulation (GDPR).