Criticality should determine the route
Supplier tiering should reflect operational dependency, data access, system access, substitutability, regulatory relevance and concentration exposure. The result should directly determine how much assurance is required.
Due diligence should test the risks that matter
Generic questionnaires often create volume without confidence. Evidence requests should be linked to the supplier role and exposure, for example assurance reports, certifications, architecture, resilience testing, incident history or specific control evidence.
Contracts are controls only when obligations are usable
Security clauses should define relevant requirements, incident notification, audit or assurance rights, subcontracting expectations, change notification and exit responsibilities. Contract language should support decisions during real events.
Monitoring should detect material change
Periodic reassessment is useful, but critical suppliers may also require event-driven review when ownership, services, hosting, certifications, incidents or financial conditions change.
Management needs concentration and escalation visibility
A mature view goes beyond individual supplier scores. Management should understand where multiple critical processes depend on the same provider, platform, geography or fourth party, and where residual exposure requires an explicit decision.