Strategy, Governance and Training
Supplier and Third-Party Security Assessment
We assess the risk your suppliers pose through their access to your systems and the services they provide. Our assessment is based on evidence, not self-declaration.
What it is
Supplier risk arises from the supplier's own security and how it connects to you. An IT supplier with remote access can be an entry point for attackers. A cloud service processing your data can affect you if it is breached. The assessment groups suppliers by this impact and examines the most critical ones in depth.
Scope
- Supplier inventory classified by access, data and criticality
- Questionnaires, evidence review and interviews for critical suppliers
- Review of supplier accounts and remote access paths in your systems
- Review of security, incident notification and audit-right clauses in contracts
- Assessment of alternatives and exit plans for a supplier outage
The need
When organizations need it
- When IT, software or call center suppliers have remote access to your systems and this access is not monitored.
- When one of your suppliers announces a breach.
- When NIS2 requires your organization or an EU customer to manage security in relationships with direct suppliers.
Method
How we work
-
Inventory
We classify suppliers by access, data and business criticality.
-
Assessment
We assess critical suppliers through evidence and interviews, and the others through questionnaires.
-
Technical check
We review supplier account privileges and remote access paths in your systems.
-
Actions
We translate findings into contract clauses, access restrictions and monitoring rules.
Outcome
What you have at the end
Your suppliers are classified by risk, and critical ones are assessed on evidence. You receive measures and contract recommendations for each supplier.
Frequently asked questions
Is the supplier's ISO/IEC 27001 certificate sufficient?
A certificate shows a management system exists, but its scope may not cover the service provided to you. Therefore, the scope and controls specific to you are reviewed separately.
Are we responsible for suppliers that process our data?
Yes. Data protection law holds you responsible for personal data processed on your behalf. For example, the GDPR requires controllers to use only processors that provide sufficient guarantees of appropriate security measures.
Strategy, Governance and Training
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting