Vendor risk management, step by step
Your suppliers hold your data, run your services and connect to your systems. Here is a practical way to assess their cybersecurity that does not stop at a questionnaire.
By the TrustSek editorial team · Last reviewed
- Frameworks
- NIS2, DORA, ISO 27001
- Steps
- Five
- Access needed
- None for step 2
A supplier's weakness becomes yours.
An attacker who cannot get into your systems can go through a supplier that already has access, holds your data or sends mail on your behalf. That is why the main frameworks all ask you to manage supplier risk:
- NIS2 lists supply chain security among the Article 21 measures, in 21(2)(d). See NIS2 supplier security.
- DORA makes financial entities fully responsible for their ICT providers in Article 28. See DORA and ICT third-party risk.
- ISO 27001:2022 has four Annex A controls on suppliers, 5.19 to 5.22: security in supplier relationships, security in supplier agreements, the ICT supply chain, and monitoring and review of supplier services.
None of them prescribes one method. What they share is a cycle: know your suppliers, assess them, agree requirements, and follow up.
1. List your suppliers and sort them by risk.
You cannot assess every supplier in depth, and you do not need to. Start with a list and three questions per supplier:
- Data: does the supplier store or process your data, and how sensitive is it?
- Dependency: would an outage at the supplier stop something important?
- Access: does the supplier connect to your network, systems or accounts?
Suppliers with a yes to any of these go in the top tier. They get the full assessment and the closest follow-up. The rest get a lighter check.
2. Gather evidence from more than one source.
| What it shows | Its limits | |
|---|---|---|
| Questionnaire | What the supplier says about its controls | Self-reported; answers are often generic |
| Certificate or audit report | That an auditor checked a defined scope, such as ISO 27001 or a SOC 2 report | Read the scope: it may not cover the service you buy |
| Outside-in evidence | What the supplier shows the internet today: email authentication, TLS, public software versions, exposure, reputation | Sees nothing inside the organisation |
| Contract | What the supplier has committed to | Only as good as your follow-up |
Outside-in evidence is the one source you can collect before the supplier answers anything, for every supplier on the list. It is also the easiest to check against the other three: when the questionnaire says one thing and the public evidence another, you have found your first question.
3. Ask about specific findings, and record the decision.
Generic questions get generic answers. Specific findings get specific ones:
- “Your mail domain publishes no DMARC policy. Is a fix planned, and when?”
- “Your customer portal still accepts TLS 1.0. Can you turn it off?”
- “Your web server advertises a version with a known exploited vulnerability. Is it patched?”
Accept evidence that a finding is wrong or already fixed. Then write down what you decided: accept the supplier, accept it with conditions and dates, or look elsewhere, and what risk remains.
4. Write the requirements into the contract.
What is not in the contract is hard to follow up. For top-tier suppliers, cover at least:
- the security requirements the supplier must meet, and how they will be shown;
- how quickly the supplier must tell you about an incident that affects you;
- your right to ask for evidence, and to audit where the risk calls for it;
- the use of subcontractors;
- what happens to your data, and how you get out, when the contract ends.
5. Review on a schedule, and when things change.
An assessment is a snapshot. Plan when it is repeated: for example yearly for the top tier, at every renewal, and whenever the supplier's role changes or it has an incident. Run the outside-in check again at the same points and compare with the earlier result. Changes in either direction are worth a question.
Where TrustSek fits.
TrustSek covers the outside-in part of step 2 and gives step 3 its questions. It scores a supplier's domain from public evidence, without access or cooperation, shows every finding with what was tested and how to fix it, and marks evidence it could not collect as not checked. TrustSek for companies shows how to add your suppliers, and What is a security rating? explains what such scores can and cannot tell you.
Questions
Should we use a questionnaire or outside-in evidence?
Both. A questionnaire covers what happens inside the supplier, which no scan can see. Outside-in evidence shows what is visible today and gives you a way to test the answers.
How many suppliers should we assess?
All of them lightly, the top tier in depth. A short list of suppliers that hold your data, run critical services or have access to your systems is a better start than a long list assessed superficially.
Do suppliers need to agree to an outside-in check?
No. It uses only public evidence. Telling suppliers that you assess them this way, and sharing the findings, usually makes the follow-up faster.
Check a supplier's domain
Start step 2 now: enter a supplier's domain and see the public evidence. The supplier is not contacted.