Most third-party risk processes follow the same pattern. A new supplier is selected. Procurement sends a security questionnaire. The supplier fills it in, often answering "yes" to almost every question, and attaches an ISO 27001 certificate. The answers are filed. The supplier is marked as assessed.
The process creates a record. It does not necessarily reduce risk.
A familiar situation
An organisation outsources its payroll processing to a specialised provider. The questionnaire is complete and positive. The provider holds a valid ISO 27001 certificate. Encryption, access control, backups and incident management are all marked as in place.
A year later, the payroll provider suffers a ransomware incident. Salaries are paid late. The organisation learns that the affected application was hosted by a subcontractor, that the certificate covered only the provider's head office and sales activities, and that the contract did not specify how quickly customers would be informed of an incident. None of this was hidden. It simply was not asked, or was not checked.
Why questionnaires give false assurance
Questionnaires are not useless. They are a reasonable way to collect basic information. The problem is what happens after they come back.
- Answers are claims, not evidence. "Do you perform regular penetration tests?" can be answered "yes" by a supplier that tested a single website three years ago.
- The questions are generic. The same list is used for a cleaning company and a cloud provider hosting the organisation's core application. Most questions are irrelevant for one and too shallow for the other.
- The scope is unclear. A supplier may answer for its best-run business unit, not for the service you are actually buying.
- Nothing happens with the answers. Negative answers are noted but not followed up, and there is no agreed point at which a finding blocks a contract or requires a measure.
- The volume is unmanageable. When every supplier gets the same treatment, the team spends most of its time on suppliers that pose little risk.
The root cause is that the process is designed to show that suppliers have been assessed, not to find out whether they can be relied upon.
Start with classification
An assessment that is proportionate to the risk begins before any questionnaire is sent. The first step is to classify suppliers by what they mean to the organisation. Useful criteria include:
- how critical the service is to business operations;
- what access the supplier has to systems, networks or physical locations;
- how sensitive the data is that the supplier processes or can see;
- how easily the supplier could be replaced, and how long that would take.
In most organisations this quickly shows that a small group of suppliers carries most of the risk. Those suppliers deserve a thorough assessment. Many others need only a light check. Some need nothing beyond standard contractual terms.
This is not cutting corners. It is the only way to give the important suppliers the attention they need with the resources that are available.
What a real assessment looks at
Certificate scope
An ISO 27001 certificate is useful, but the first question is always what it covers. The scope statement on the certificate names the organisation, locations and activities included. If the service you are buying, or the location where it is delivered, is not in that scope, the certificate tells you very little about it. The Statement of Applicability can also show which controls the supplier has excluded and why.
Evidence
For important suppliers, claims should be supported. That can mean a SOC 2 Type II report covering the relevant service and period, a summary of a recent penetration test with the status of findings, evidence of backup and restore tests, or an extract from the access review process. The aim is not to audit the supplier completely. It is to verify the claims that matter most for the risk you are accepting.
Subcontractors
Many services are built on other services. A software provider may host on a cloud platform, use an external support desk and rely on a third party for payments. Ask which subcontractors are involved in delivering your service, where your data is located and how the supplier manages these parties. If the answer is unclear, so is your risk.
Continuity and exit
For critical suppliers, ask what happens if the service is unavailable for a week. Does the supplier have a tested continuity plan for this service? Can you get your data back in a usable format? How long would it take to move to an alternative? These questions are often uncomfortable because the honest answer is "we have not thought about it".
Incident notification
Check what the supplier will tell you, how quickly and through which channel when something goes wrong. A notification period of "without undue delay" leaves room for interpretation. For suppliers involved in critical processes or processing personal data, the contract should be specific, and the notification should reach someone in your organisation who can act on it.
Contractual follow-up
Findings only reduce risk if they lead to something: a measure the supplier agrees to implement, an adjustment to the contract, an extra control on your own side, or a documented decision by a risk owner to accept the remaining risk. Each finding should have an owner and a date.
Depth should follow risk
A useful structure is to work with several assessment levels. A light check for lower-risk suppliers focuses on classification, a short questionnaire and a check of certificates and declarations. A standard assessment for important suppliers adds evidence review and a closer look at subcontractors and incident arrangements. A critical supplier assessment involves interviews, deeper evidence review, continuity and exit analysis and, where appropriate, technical verification.
The level is decided by the classification, not by habit or by who in the organisation is asking. That makes the outcome defensible to auditors and regulators, including under NIS2, which expects organisations to manage the security of their supply chain in proportion to the risk.
Who should be involved
Supplier security is often placed with a single person in the security team, who receives questionnaires and returns a verdict. That rarely works well, because the decisions involved belong to several roles:
- The business owner of the service knows how critical it is, how quickly an alternative could be found and which residual risk is acceptable. They should approve the classification and accept any remaining risk.
- Procurement controls the moment when security can still be influenced: before the contract is signed. They need to know which suppliers require an assessment and which contractual clauses are standard.
- Legal ensures that notification, audit, data processing and exit provisions are enforceable.
- The security or privacy specialist designs the assessment, evaluates evidence, identifies gaps and advises on measures.
- IT or the technical owner checks how the supplier is connected: which accounts, interfaces and access routes exist and whether they match what was agreed.
A short agreement on who does what, and when an assessment must be completed in the procurement process, prevents the common situation where security is asked to approve a supplier the day before the contract is signed.
Dealing with suppliers who will not cooperate
Large cloud and software providers often decline individual questionnaires and refer to their published assurance reports instead. That is reasonable, provided the reports cover the service in question and are actually read. Smaller suppliers sometimes cannot provide formal evidence at all. In that case, a short conversation with someone who runs the service, a demonstration of key controls or a few targeted questions about recent incidents can tell you more than a long form. If a critical supplier is unwilling or unable to provide any assurance, that is itself a finding that the business owner needs to consider.
Keep it current
A supplier assessment is a snapshot. Services change, subcontractors change and suppliers have incidents. Each assessment should end with a reassessment date based on the risk level, and there should be clear triggers for an earlier review: a significant incident at the supplier, a change of ownership, a change in the service or the data involved.
Relevant threat information also helps. If a supplier's sector or a widely used product becomes a known target, that is a reason to check whether your exposure has changed. This is where threat intelligence and supplier management meet.
Three things to do this quarter
- Identify your ten most critical suppliers based on business dependency and access, not on contract value. Check when each was last assessed and how.
- Read the certificate scope of the three most important ones. Confirm that the service you buy is actually covered.
- Check incident notification terms in those contracts. If they are vague, agree a concrete notification period and a named contact on both sides.
Conclusion
A questionnaire is a way to start a conversation with a supplier. It is not the conclusion. Real supplier assessment means knowing which suppliers matter, checking what their assurance actually covers, verifying the claims that carry the most risk and making sure findings are followed up. That takes more effort for a few suppliers and less for many, which is a better use of time than sending the same list to everyone.
The Supply Chain Security page describes the three assessment levels FLODISQ uses and what each one includes. If your supplier management process itself needs clearer roles and decision rules, that is part of Security Governance.