Key takeaways
- •Map critical suppliers and service dependencies.
- •Understand what data or systems each supplier can access.
- •Set clear access, notification and recovery expectations.
- •Review assurance evidence in proportion to the relationship.
Identify important relationships
Start with suppliers that support critical services, hold sensitive information, administer systems or have broad network access. Document the business owner and relevant technical contact.
Understand access and data flows
Clarify accounts, integrations, support routes and data exchanged. Remove access that is no longer needed, and make changes visible to a named owner.
Use proportionate assurance
Ask for evidence appropriate to the service and risk. Questionnaires can inform a conversation but do not prove that a supplier is secure. Keep a record of assumptions and unresolved actions.
Plan for disruption
Understand notification channels, service dependencies and recovery arrangements. Consider what happens if a supplier is unavailable or an account is compromised.
Keep the review current
Revisit important suppliers after material changes, incidents, contract renewals or new integrations. Risk changes as the service and access change.
Sources and further guidance
Official guidance may change. Check the source directly for current requirements. This article is general information, not legal advice.
Put your next step into context.
A free 30-minute cybersecurity review provides a Red, Amber or Green score and prioritised fixes.
Book a review