After reading, you can scale your checks to the stakes, read a supplier's evidence critically, and reach a recorded decision.
Definition
It happens before signing and again during the relationship. ISO/IEC 27002 controls 5.19 to 5.22 cover supplier relationships, and NIS2 Article 21(2)(d) names supply chain security.
How deep you go depends on the stakes. A supplier holding customer data deserves far more scrutiny than one delivering office supplies.
Why it matters
You can outsource a service, but the responsibility stays with you. Under GDPR Article 28, for instance, a controller may only use processors offering sufficient guarantees.
How it works
Describe the service: what data is shared, what access is granted, how much the business depends on it, how easily it could be replaced. A tier follows from that.
Ask for evidence in proportion: a certificate with its scope and Statement of Applicability, a SOC 2 report, a questionnaire, a penetration test summary. Read what you receive, exclusions included.
Rate the remaining risk. Then approve, approve with conditions written into the contract, or refuse. Record who decided and when the next review falls due.
A worked case
A company is choosing a payroll provider that will hold salary and bank data for 200 staff, which puts it in the top tier. Reading the ISO/IEC 27001 certificate closely, the team sees that it excludes the support centre, whose agents can view records.
The decision is to approve on three conditions: access logs, breach notice within 24 hours in the contract, and yearly evidence of a review covering the support centre.
Good practices
- Tier first, so that the effort goes where it matters.
- Turn what you find into contract clauses. A finding with no clause has no force later.
- Ask about subcontractors for critical services.
- Plan the end of the contract too, including the return of your data.
Common mistakes
- Sending the same long questionnaire to everyone, which exhausts small suppliers and buries the answers that matter.
- Accepting a certificate without reading its scope.
- Assessing once at signing and never again, though the supplier and its risks will change.
- Deciding after the contract is signed, when you have little left to negotiate with.
Questions
- How does a vendor risk assessment relate to third-party risk management?
- The assessment evaluates one supplier at a point in time. Third-party risk management is the whole programme around all of them.
- How often should vendors be reassessed?
- Critical ones at least yearly, and after an incident or a change in service. Lower tiers less often, or on renewal.
- Is a SOC 2 report enough to assess a vendor?
- It is strong evidence if its scope, period and exceptions fit your use, though you still need to think about your own dependency.
- What if a critical supplier refuses to answer?
- Look for public evidence, negotiate, record the risk, and let its owner decide. A refusal is itself a piece of information.
- What are fourth parties?
- Your suppliers' suppliers. They matter when your service depends on them, such as the cloud platform behind a SaaS tool.