Why it matters
Attackers increasingly reach large organisations through smaller suppliers. Regulators in banking and other sectors also hold organisations accountable for the risks of outsourced services.
What to get right
- Tier suppliers by the access and data they have, and focus effort on the critical tier.
- Ask for evidence, not just questionnaires: certifications, test results and incident history.
- Write security, breach notification and audit rights into contracts.
- Monitor critical suppliers continuously, not only at onboarding.
Common questions
How many suppliers should we assess in depth?
Usually a small fraction. Tiering lets you apply deep assessment to the suppliers whose failure would hurt most, and lighter checks to the rest.
Do certifications like ISO/IEC 27001 remove the need to assess a supplier?
They help, but check the certificate's scope covers the service you use, and still review how the supplier would notify you of an incident.