Your security is only as strong as the organisations you depend on.
Your critical data, systems and business processes rarely sit entirely within your own organisation. Cloud providers. Software vendors. Managed services. Data processors. Technology partners. Specialist suppliers. Each one can introduce risk.
FLODISQ helps organisations understand which suppliers really matter, assess their security, verify the evidence behind their claims and turn the findings into practical action.
Not another supplier questionnaire. Actual supplier risk assessment.
Know where the risk really is
Hundreds or even thousands of suppliers can make supply chain security look like an impossible problem. It does not have to be.
Not every supplier needs the same level of scrutiny. A supplier processing sensitive data or operating a critical service deserves a very different assessment from a low-risk commodity provider.
FLODISQ uses a risk-based approach to identify where deeper investigation is justified.
From questionnaire to evidence
Many supplier assessments stop when the questionnaire comes back. We go further.
Depending on the risk, FLODISQ reviews the controls, the scope and quality of available assurance, the dependencies beneath the service and the supplier’s ability to respond when something goes wrong.
We look at factors such as:
- Criticality of the service
- Access to systems, networks or locations
- Sensitivity of data
- Business dependency and replaceability
- Security maturity
- Certifications and available assurance
- Use of subcontractors and other third parties
- Business continuity and exit risk
Policies & controls
Do the documented controls address the risks relevant to your organisation?
ISO 27001 & assurance
What does the certification actually cover, and what falls outside its scope?
SOC reports & evidence
What can independent assurance demonstrate about the supplier’s controls?
Penetration tests & vulnerabilities
What do available technical reports say about exposure and remediation?
Business continuity
Can the supplier continue delivering the services you depend on?
Incident management
Will you know quickly enough if something goes wrong?
Subcontractors & dependencies
Who else is underneath the service you are buying?
Contractual security
Are responsibilities, notification, audit and exit provisions adequate?
Three levels of assessment
The assessment level follows the supplier’s risk, criticality and complexity. This keeps the work proportionate and concentrates specialist effort where it matters most.
Supplier Check
For suppliers with lower or well-controlled risk.
Typical effort: 4–8 hours
- Supplier risk classification
- Focused security questionnaire
- Review of relevant certifications and declarations
- Targeted evidence check
- Identification of material gaps
- Supplier risk rating
- Recommended actions
- Reassessment date
Supplier Assessment
For important suppliers requiring more assurance.
Typical effort: 8–24 hours
- Everything in Supplier Check
- Detailed security assessment
- Evidence review and certification scope review
- Security policy and contract security review
- Supplier clarification and follow-up
- Risk and mitigation assessment
- Formal supplier assessment report
Critical Supplier Assessment
For critical, complex or high-risk suppliers.
Typical effort: 24–40+ hours
- Everything in Supplier Assessment
- In-depth evidence review
- Verification interviews
- Review of relevant penetration test or assurance reports
- Business continuity and incident response assessment
- Subcontractor and supply chain analysis
- Dependency and exit risk
- Tailored recommendations and management-ready report
| Supplier Check | Supplier Assessment | Critical Supplier | |
|---|---|---|---|
| Price | From €750 | From €1,750 | From €4,250 |
| Questionnaire | Focused | Full | Full |
| Evidence review | Basic | Detailed | In-depth |
| Supplier interaction | If required | Included | Included |
| Verification interview | – | Optional | Included |
| Supply-chain analysis | – | Targeted | In-depth |
| Risk report | Summary | Full | Full + management view |
| Recommendations | Included | Included | Tailored |
All prices exclude VAT. The final assessment level is determined after supplier classification. The price assumes timely access to relevant information and reasonable supplier cooperation. Exceptionally complex scope, repeated follow-up or additional technical testing is agreed separately.
Build a working TPRM programme and assess your supplier portfolio.
For organisations that need more than individual assessments, FLODISQ can establish and operate the complete supplier security process.
- 01
Discover
Build or improve the supplier register and determine which suppliers are in scope.
- 02
Classify
Prioritise suppliers based on criticality, data, access, dependency and security risk.
- 03
Assess
Perform proportionate assessments using the appropriate level of scrutiny.
- 04
Improve
Translate findings into mitigations, contractual requirements and supplier actions.
- 05
Monitor
Define reassessment cycles, ownership, escalation and management reporting.
- 06
Transfer
Leave behind a process the organisation can continue to operate.
Programme pricing
TPRM Starter
Set up the foundations and prove the approach with a pilot.
- Current-state review
- TPRM policy and process
- Supplier classification model
- Three assessment levels and evidence requirements
- Supplier register structure
- Pilot with up to 3 suppliers
- Implementation roadmap
TPRM Implementation
Roll out a complete, operating programme across your supplier portfolio.
- Everything in Starter
- Supplier portfolio classification
- Governance and ownership
- Procurement integration
- Assessment waves
- Management reporting and action tracking
- Escalation process
- Reassessment calendar
- Knowledge transfer
For larger portfolios, FLODISQ provides bespoke volume pricing based on the expected mix of Supplier Checks, Supplier Assessments and Critical Supplier Assessments. All prices exclude VAT.
Already have a TPRM process?
We can do the assessments for you.
You may already have policies, questionnaires and supplier management processes in place. But someone still needs to do the work. FLODISQ can operate as your specialist assessment capacity, reviewing suppliers against your existing methodology or ours.
You keep ownership of the process. We provide the analysis.
Built for NIS2, ISO 27001 and real-world risk
Supply chain security is no longer just a procurement concern. FLODISQ can align supplier assessments with the frameworks and requirements that apply to your organisation.
Compliance is not the end goal. The real question is simple: can this supplier expose your organisation to unacceptable risk?
- NIS2
- ISO/IEC 27001 and 27002
- Existing security policies
- Procurement and privacy requirements
- Contractual security requirements
- The organisation’s own risk methodology
What you get
Not just a questionnaire. At the end of an assessment you know:
What was checked
What was found
Why the issue matters
What needs to happen
Who owns the action
When the supplier should be reassessed
How well do you really know your suppliers?
Start with one critical supplier, assess a portfolio, or build a complete Third Party Risk Management programme.