In brief
- Tier suppliers by dependency and impact. Spend is a weak proxy for cyber risk. A low-cost provider can still be operationally critical if it holds privileged access, sensitive data or a hard-to-replace service.
- Ask for evidence, not reassurance. Certifications, audit reports, test results, architecture information, incident records and control evidence are more useful than a questionnaire answer with no support.
- Put security into the relationship. Contractual requirements, incident notification, change communication, access control, subcontractor expectations and exit arrangements should reflect the supplier's criticality.
- Monitor concentration and exceptions. A supplier can be individually acceptable while the portfolio remains fragile because many critical services depend on the same cloud, identity, software or managed-service provider.
Why questionnaire-led third-party risk breaks down
Traditional supplier risk programmes often start with one large questionnaire and apply it to almost every vendor. That creates volume rather than control. Low-risk suppliers receive questions that do not matter, critical suppliers can disappear inside the same workflow, and procurement teams learn to optimise completion instead of risk reduction.
NIS2 raises the importance of supply chain security for essential and important entities. Article 21 includes supply chain security and security-related aspects of relationships with direct suppliers and service providers among the cybersecurity risk-management measures to be addressed. For some digital and ICT service provider categories, Commission Implementing Regulation (EU) 2024/2690 adds more detailed requirements, including a supply chain security policy and risk-based security expectations for direct suppliers and service providers.
Governancy view: the unit of control is not the questionnaire. It is the dependency. Understand what can fail, how badly it can hurt you and what evidence makes the remaining risk acceptable.
1. Tier suppliers by criticality
Tiering determines how much attention a supplier deserves. A useful model considers the consequence of supplier failure and the degree of access or dependency, not only annual spend.
| Factor | Questions to ask |
|---|---|
| Service criticality | Would failure stop a critical or regulated service? How quickly would impact appear? |
| Data | Does the supplier process sensitive, confidential, regulated or high-volume data? |
| Access | Does it have privileged, remote, production or administrative access? |
| Replaceability | How long would substitution take? Are data portability, skills or integrations barriers to exit? |
| Connectivity | Is the supplier directly integrated into identity, network, software delivery or operational technology? |
| Concentration | Do multiple critical services depend on the same provider, technology or upstream platform? |
Tier 1: critical
Material service, data or access dependency. Requires deeper due diligence, evidence, contractual controls, defined monitoring and executive visibility for material exceptions.
Tier 2: significant
Meaningful dependency with moderate impact or replaceability. Requires targeted evidence and periodic review, but not the full critical-supplier process.
Tier 3: standard
Limited impact and low access. Use minimum baseline requirements and efficient onboarding controls.
Tier 4: negligible cyber exposure
No meaningful system, data or service dependency. Keep procurement hygiene without forcing a full cyber assessment.
2. Match evidence to the risk
Evidence should reduce uncertainty about the risks that matter. A certification can be useful, but it should not automatically close due diligence. Scope, exclusions, recency and the actual service you consume still matter.
- Independent assurance: relevant ISO certification, SOC reports or other external assurance where the scope matches the service.
- Technical evidence: penetration-test summaries, vulnerability-management evidence, secure development practices, architecture or segregation information where relevant.
- Operational evidence: incident handling, backup and recovery testing, privileged access reviews, business continuity exercises and change management.
- Governance evidence: policies, risk ownership, internal audit, management review and corrective-action tracking.
- Service-specific evidence: data locations, subprocessors, support model, dependency chain, recovery commitments and notification mechanisms.
Do you know which suppliers deserve closer scrutiny?
Assess critical dependencies, evidence and governance in a proportionate third-party risk approach.
Explore Third-Party Risk Management3. Put the control into the contract
Due diligence is strongest when the agreed controls become part of the relationship. The exact clauses depend on risk, bargaining power, applicable law and service type, but critical relationships commonly need clarity on:
Security baseline
The minimum security practices, standards or control outcomes the supplier is expected to maintain.
Incident notification
When and how the supplier must notify you of incidents that can affect your services, systems or information.
Material change
Notification for changes in hosting, ownership, control environment, critical subprocessors or service architecture when those changes affect risk.
Assurance rights
Access to relevant assurance evidence, audit rights or alternative verification mechanisms proportionate to the relationship.
Subcontractors
Expectations for security in the supplier's own chain, especially where critical parts of the service are outsourced.
Exit and continuity
Data return or deletion, transition support, recovery commitments and practical options if the supplier fails or must be replaced.
4. Monitor what can materially change
Annual reassessment is too slow for some critical dependencies and unnecessarily heavy for others. Monitoring should match the change rate and criticality of the service.
| Trigger | Governance response |
|---|---|
| Material security incident | Assess impact, evidence, remediation, notification obligations and whether continued use remains acceptable. |
| Major service or architecture change | Revisit data, access, resilience and dependency assumptions. |
| Change of critical subprocessor | Assess whether upstream risk or location changes the accepted position. |
| Expired or qualified assurance | Request updated evidence or establish temporary compensating controls and an owner. |
| Repeated SLA or resilience failures | Escalate from vendor performance into operational and cyber resilience governance. |
| Acquisition or financial distress | Review continuity, ownership, access, contractual rights and exit readiness. |
5. Manage concentration risk above the supplier level
Supplier-by-supplier assessments can all be green while the organisation remains exposed to one underlying failure point. Common concentration patterns include many critical SaaS services relying on the same cloud provider, multiple applications using one identity provider, several outsourced services depending on the same managed service provider, or critical software sharing one update or code-signing dependency.
Track concentration separately from individual supplier ratings. Management should know which external dependency could affect several critical services at once, whether alternatives exist and whether recovery plans assume the same provider remains available.
6. Make exceptions explicit
No supplier programme eliminates every gap. The control is in how exceptions are governed. A material exception should record the risk, reason, owner, compensating measures, expiry or review date and the conditions that trigger escalation.
Accept
The residual risk is within authority and appetite. Record who accepted it and for how long.
Mitigate
Add technical, contractual, process or monitoring controls to reduce exposure.
Escalate
The risk exceeds normal authority or affects a critical service and requires senior decision.
Exit or avoid
The dependency cannot be made acceptable at reasonable cost or within required time.
A practical end-to-end operating model
Identify
Maintain a supplier inventory connected to services, systems, data and business owners.
Tier
Determine criticality before choosing the due-diligence depth.
Assess
Ask targeted questions and collect evidence that relates to the dependency.
Contract
Turn material control expectations into enforceable relationship requirements where appropriate.
Approve exceptions
Make residual risk and temporary gaps visible to the right authority.
Monitor
Use event-driven and periodic review based on criticality.
Review concentration and exit
Look across the portfolio and test whether critical dependencies can fail together.
Metrics management can actually use
- Percentage of tier-1 suppliers with current assessment and evidence.
- Number of material supplier exceptions past their review date.
- Critical suppliers without tested continuity or exit assumptions.
- Critical services dependent on a single external provider or technology concentration.
- Time to close high-risk supplier findings.
- Material supplier incidents and whether corrective actions were completed.
Primary sources
- Directive (EU) 2022/2555, Article 21 on cybersecurity risk-management measures and supply chain security
- Commission Implementing Regulation (EU) 2024/2690, for the entity types within its scope
- ENISA, Good Practices for Supply Chain Cybersecurity
Practical next step: If your supplier programme measures questionnaire completion but cannot tell management which dependencies matter most, start with tiering and evidence. Discuss the scope with Governancy.