Tools & Resources / CQUEST / Cyber resilience
CQUEST Self Assessment Questionnaire | Cyber Resilience
A connected view of cyber resilience, from governance and leadership through to recovery.
The context
CQUEST: why the UK regulators’ “cyber questionnaire” still matters in 2025
When the Bank of England, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) talk about operational resilience, most people think of red-team exercises such as CBEST or STAR-FS. Yet in the background sits a quieter—but surprisingly powerful—tool: CQUEST, the 50-question Cyber Questionnaire that has become a staple of supervisory conversations.
Interactive / Self-assessment
Explore your cyber-resilience priorities.
Use the CQUEST self-assessment to examine your resilience and the evidence behind it.
Opens in a modal. Your answers stay in the assessment.
01 / How it works
From pilot to pillar of the supervisory toolkit
CQUEST first appeared as part of a pilot in 2019, when six banks and seven insurers were asked to complete a spreadsheet covering the full life-cycle of cyber resilience. The regulators liked what they saw: a relatively light-touch way of creating a maturity “heat-map” that boards could understand. By March 2025 the questionnaire is explicitly listed on the Bank of England’s operational-resilience pages as one of the three headline cyber-assessment tools—alongside CBEST and STAR-FS—available to both supervisors and firms who want to self-assess.
Its design is deliberately simple. Firms answer multiple-choice questions spread across six domains—Governance & Leadership, Identify, Protect, Detect, Respond and Recover—mirroring the structure of the NIST Cybersecurity Framework. Once complete, the spreadsheet colours the answers amber, red or green, producing an immediate visual of where capability gaps sit.
The take-up has been significant. A line buried in the PRA’s 2020-21 Annual Report notes that “over 100 firms” had already used CQUEST as a key input to supervisory work that year, an early indication of its value across banking and insurance portfolios . Since then, the tool has been refreshed several times—the latest version landing in March 2025—and remains a live instrument in regulatory engagement.
02 / Value for the business
Why would a firm voluntarily pick up CQUEST in 2025?
1. A low-cost early-warning system
CBEST or STAR-FS demand months of planning, specialist providers and six-figure budgets. By contrast, a single workshop with the CISO, IT operations lead and risk team can populate CQUEST in days. The output flags weaknesses before they surface during a Section 166 or a thematic review, giving management time to fix them quietly.
2. A language the board can read
Because each multiple-choice answer translates directly to a colour on the heat-map, directors with no cyber background can grasp—in one slide—whether the firm is behind peers on “Detect” or “Recover”. That clarity is gold dust under the Senior Managers & Certification Regime, especially for the SMF24 (Chief Operations Function) holder.
3. Peer benchmarking ammunition
Regulators collate CQUEST scores sector-wide; supervisors often share anonymised quartile data. Armed with “we are bottom-quartile on ‘Respond’”, CISOs can argue for budget without resorting to fear-based hypotheticals.
4. Complements the broader resilience agenda
The UK’s operational-resilience rules (Impact Tolerances, Important Business Services) and the incoming EU DORA regime both force firms to think beyond perimeter defence. CQUEST’s six-domain structure naturally surfaces blind-spots in response, recovery and learning—areas that penetration tests rarely quantify.
5. A proportionate option for smaller institutions
Building societies, mid-tier insurers and challenger banks often lack the resources for STAR-FS. CQUEST provides a regulator-recognised yard-stick they can point to during capital-adequacy or third-party-risk discussions.
6. Year-on-year improvement metric
Repeat the questionnaire annually and you have a consistent set of numbers to show how last year’s investment moved “Detect” from basic to advanced. That tangible evidence satisfies auditors, regulators and cyber-insurance underwriters alike.
03 / Put it to work
Making the most of the questionnaire
If you are tempted to give CQUEST a spin, start by asking your usual PRA or FCA supervisory contact for the latest spreadsheet. (Regulators prefer you work from the current template rather than an outdated copy circulating online.)
Next, convene a cross-functional session: IT, security operations, business continuity, risk and compliance.
Document the evidence behind each answer—supervisors will sometimes ask for proof.
Finally, translate the coloured heat-map into a remediation plan with clear owners, funding and dates; link those actions back to your operational-resilience impact tolerances so cyber workstreams feed a single narrative.
The bottom line
CQUEST will never replace a full threat-led penetration test, nor is it designed to. What it does offer is an inexpensive, regulator-endorsed mirror—one that lets financial-sector firms spot cyber-resilience blind-spots early, speak a common language with the board, and track progress year after year. In an environment where cyber risk keeps climbing regulatory agendas, that’s a compelling proposition.
Interactive / CQUEST
Give it a try
Click the button below to try our simple CQUEST self assessment tool. We don’t store or collect any of the information you enter in the form, nor identify the assessee in any way.