Which supplier failures could stop your business?

How should we decide which suppliers to assess first?

Assess suppliers according to service criticality, access privileges, information sensitivity and the difficulty of replacing them. Contract value alone is a poor proxy for security risk. A low-cost support provider with administrative access can matter more to resilience than a larger contract with little connection to essential systems.

Scope discovery across procurement, finance, IT and business teams so that subscriptions and locally arranged services are not missed. Record the internal owner, service purpose, data involved, access route and dependent business activities. Agree what counts as a supplier relationship, including managed service providers and relevant subcontractors. The engagement should produce a usable register and a reasoned assessment order, not an unexplained ranking based on generic company attributes.

Does an ISO 27001 certificate answer our security questions?

An ISO 27001 certificate offers evidence about an assessed management system within a defined scope, but it does not answer every question about the service you buy. Check the legal entity, service boundary and certification arrangements. A certificate covering one operation should not be treated as assurance for every subsidiary or product.

Ask for evidence proportionate to the relationship. An independent assurance report may explain controls and exceptions; a questionnaire records the supplier's assertions; a technical test examines a particular system under defined conditions. They are not interchangeable. Consider whether the evidence covers privileged access, incident handling, recovery and customer responsibilities. Avoid demanding detailed security material that your organisation cannot protect or interpret, and document gaps that remain after the review.

How far down the supply chain should the scope go?

The scope should reach far enough to understand material dependencies and the supplier's management of subcontractors, without pretending complete visibility is always possible. Ask which external services are essential to delivery and which parties handle your information or support privileged operations.

Different suppliers may depend on the same cloud platform, identity service or communications provider. That concentration can undermine an assumption that separate contracts provide independent resilience. Record where visibility is limited and whether contractual notification or alternative arrangements can reduce uncertainty. For personal data processing, involve privacy specialists in reviewing controller and processor roles, subprocessor arrangements and international transfers. A general cyber questionnaire cannot substitute for the specific contractual and legal assessment those relationships may require.

What should contracts say about security incidents?

Contracts should establish practical notification, cooperation and information-sharing duties appropriate to the service and applicable law. Define contact routes, the information expected at initial notification, how updates will follow and who can authorise urgent containment affecting your organisation. Qualified legal advisers should turn those requirements into suitable wording.

Check whether the supplier can support investigations, preserve relevant evidence and explain recovery decisions. Avoid relying on an audit right that is impossible to exercise or a reporting clause with no operational contact. Align supplier escalation with your own incident response plan. Include handling of significant service changes, access reviews and unresolved assurance findings. The engagement should identify which improvements can be agreed now and which depend on renewal or commercial negotiation.

What makes a supplier risk assessment maintainable?

A maintainable assessment has a business owner, review triggers, recorded decisions and a credible exit plan. Review should respond to changes in service, access, ownership, incidents or assurance evidence rather than becoming a questionnaire exercise detached from procurement and operations.

Specify how data can be exported, which formats and dependencies affect migration, how accounts are revoked and how deletion or retention is confirmed. Contractual portability is less useful if nobody has checked whether the exported information can support continued operations. The handover should include the supplier register, assessment rationale, findings, accepted risks and outstanding negotiations. Connect the work to purchasing approvals so a new supplier cannot bypass the process simply because a team can subscribe without central IT involvement.

Source: NCSC supply-chain security guidance. For management system assurance, read the ISO 27001 scoping guide; obtain qualified privacy and legal advice for data-processing and contract requirements.