Virtual CISO · Supplier risk
Supplier security assessed the way NIS2 asks, not by spreadsheet
Almost every organization already does this in some form: a questionnaire sent at onboarding, answers filed in a shared folder, and nobody reading them again until something goes wrong. The directive asks for something different — not that you collected answers, but that you decided something because of them.
How much this supplier could cost you, before asking them anything
The first question is not how secure a supplier is. It is how much damage their failure would do to you — what data they hold, what process of yours stops without them, whether they can reach your network, and how quickly you could replace them. That judgment is yours to make and it needs nothing from the supplier.
It also decides how much effort the rest deserves. A cloud payroll provider holding personal data for your whole workforce and a company that services the air conditioning are not the same risk, and sending both the same forty-question form is how supplier assessment turns into an exercise everybody resents and nobody reads.
Questions that fit what the supplier actually does
The security questionnaire goes to the supplier through the portal, with somewhere to attach evidence rather than only tick boxes — a certificate, a policy extract, a recent test report. Where a supplier will not or cannot engage, we complete the assessment from what can be established independently, and the record says which of the two happened, because an answer the supplier gave and an answer we inferred are not the same evidence.
The question set follows the relationship. A supplier processing personal or sensitive data is asked about lawful basis, sub-processors, retention and breach notification. A SaaS or software supplier is asked about development practice, vulnerability handling, tenancy separation and what happens to your data when the contract ends.
- Evidence attached to answers, so a claim and its proof arrive together rather than in two different emails
- The same question set across comparable suppliers, which is what makes the answers comparable at all
- A record of who answered and when, because an assessment with no date is an assertion about the past
Inherent risk, residual risk, and a person who signs the verdict
Inherent risk is what the relationship would cost you if the supplier did nothing well. Residual risk is what remains given what they demonstrably do. The distance between them is the value of their controls, and plotting both on a matrix is what makes a portfolio of suppliers comparable at a glance.
The two risk ratings are calculated. The verdict at the end is not: a named expert sets the supplier to pass or to fail and writes down the grounds — because that outcome has commercial consequences for a relationship that belongs to somebody in your organization, and the first thing they will ask is who decided and on what basis. A score cannot answer that question. The reasoning goes into the supplier’s notes, where it stays attached to the record and prints in the report.
- Pass — the residual risk is within tolerance and the evidence supports it
- Fail — the risk is not acceptable at the current level, which is a finding for a contract owner, not for IT
- Ready for review — nobody has decided yet. It is where a supplier sits before the verdict, not a softer verdict of its own, and it stays visibly undecided rather than passing by default
Assess a shared supplier once
Where several companies in a group use the same supplier, the assessment is held once and shared between them. Each company keeps its own impact judgment — the same provider can be critical to one subsidiary and peripheral to another — but the questionnaire, the evidence and the expiry date are not collected four times.
For a group with a central security function, this is usually the first place the portal pays for itself, because it is the clearest example of work that was genuinely being done four times.
A supplier report somebody outside the process can read
Per supplier: the impact judgment, the answers and their evidence, the inherent and residual position, the verdict and who set it, and the review date. Per portfolio: where your suppliers sit on the matrix and which of them are overdue.
This is the document an auditor asks for under NIS2 and the one a certification body asks for under ISO 27001, and it is also the one your own board should be reading — supplier failure is among the few security events where the loss lands on you and the fix does not.
Three different jobs that all involve a questionnaire
This page is you assessing your suppliers by asking them, and judging the answers. It is periodic, it depends on their cooperation, and it covers the things only they can tell you — how they develop software, who their sub-processors are, what their own incident process is.
Watching a supplier’s external attack surface is a different service and it runs continuously, without asking them anything: expired certificates, exposed services, credentials appearing where they should not. The two answer different questions and the honest position is that you want both — a supplier can answer a questionnaire impeccably on the same day a forgotten server of theirs is reachable from the internet.
And if what is actually happening is that your own customers are sending questionnaires to you, that is the opposite direction and it has a page of its own. The work is different, the deadline is somebody else’s, and the thing being bought is an answer rather than an assessment.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
It happens, particularly with large suppliers who receive hundreds of these. We then assess from what can be established independently and record that this is what we did — an answer the supplier gave and an answer we inferred are not the same evidence, and an assessment that blurs the two is worth less than no assessment. The refusal is itself a finding worth putting in front of whoever owns the contract, because it is a fact about the relationship rather than about security.
No, and trying to is the most common way this work collapses. The impact judgement comes first and it decides the effort: a provider holding personal data for your whole workforce and the company servicing the air conditioning are not the same risk. Most organizations end up with a short critical list, a larger list on a lighter question set, and a long tail that is recorded but not assessed — which is a defensible position, provided the reasoning is written down rather than implied by silence.
Different question, different method, and you probably want both. This page is you asking your suppliers and judging the answers: periodic, dependent on their cooperation, and the only way to learn things only they know — how they develop software, who their sub-processors are, what their incident process is. Supply Chain Defense watches their external attack surface continuously and without asking anyone. A supplier can answer a questionnaire impeccably on the same day a forgotten server of theirs is reachable from the internet.
Where this sits, and what comes next
Business continuity
Which processes you cannot lose, for how long, and what that costs per month.
Board reporting
The monthly pack: scores, movement, and one slide a board will actually read.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.