Your suppliers hold some of your keys. Know which ones.
We help you list your suppliers, rank them by what they can reach, ask the right questions and check the answers against evidence.
Overview
Why supplier risk is your risk
Every hosting provider, software vendor, payroll service and contractor with remote access extends your attack surface. When one of them is breached, your data and your clients are part of the story, whatever the contract says.
Regulation has caught up with this. NIS2 includes supply chain security in the cybersecurity risk management measures it requires. DORA sets detailed rules for ICT third-party risk in the financial sector, including contractual requirements and a register of information on ICT third-party arrangements. ISO/IEC 27001 has supplier controls of its own.
We build a process you can run with the people you have: an inventory, tiers that decide how much scrutiny each supplier gets, questionnaires proportionate to the tier, and a review of the evidence behind the answers. A questionnaire is a statement. We ask for the receipts.
Who it is for
Organisations in scope of NIS2 or DORA, companies preparing for ISO/IEC 27001 or SOC 2 who need a supplier process, and teams that receive a growing pile of vendor questionnaires on one side and send none on the other.
The work, from scoping to evidence.
What we do
Supplier inventory
Every third party that touches your data, systems or critical services, with the owner, the access and the service it provides.
Tiering
Criteria that sort suppliers by criticality and access, so the effort goes where the exposure is.
Questionnaires
Security questionnaires sized to each tier, using recognised structures where they fit, and short enough to come back completed.
Evidence review
We review the evidence behind the answers, such as ISO/IEC 27001 certificates and their scope, SOC 2 reports, penetration test summaries and policies.
Contract clauses
Security requirements, notification duties, audit rights and exit provisions for your contracts, drafted for your legal team to adopt.
Ongoing monitoring
A review cycle per tier and triggers for reassessment, such as an incident, a change in service or a contract renewal.
How the engagement runs
Kickoff
We agree the scope, the regulations that apply and the people involved, and sign an NDA first if you need one.
Proposal
A business proposal with the method, the scope and the contract type that suits you.
Inventory and tiering
Workshops with procurement, IT and business owners to build the supplier list and assign tiers.
Assessment
Questionnaires sent to the suppliers in scope, followed by evidence review and follow-up questions.
Results handover
A risk rating for each assessed supplier, recommended actions and a business report for management.
Closing
Project close with feedback, and optional ongoing support to run the cycle.
What you receive
- Supplier inventory with owners and access
- Tiering criteria and assigned tiers
- Questionnaire set per tier
- Assessment reports for the suppliers in scope
- Model contract clauses for security
- Third-party risk procedure with review cycle
Questions
Do you assess our suppliers directly?
Yes, with your agreement and theirs. Usually through questionnaires and evidence review. Where a contract allows it and the risk justifies it, we can also run an on-site or technical assessment, such as a penetration test of a supplier's service.
Is a supplier's ISO/IEC 27001 certificate enough?
It is good evidence, but check the scope. A certificate that covers one data centre says little about the service you buy from another. We read the scope statement and the Statement of Applicability where the supplier shares it.
What does DORA add?
For financial entities, DORA sets specific rules for managing ICT third-party risk, including what contracts must contain and keeping a register of information on ICT third-party arrangements. We help you set up the process and the register; the legal interpretation stays with your counsel.
Can you also help us answer questionnaires we receive?
Yes. An information security audit against the client's questionnaire is one of our services.
Related services
- Compliance and certificationNIS2NIS2 support from Black Fox Security: applicability check, gap assessment against the risk-management measures, incident reporting, supply chain and training.
- Compliance and certificationDORADORA support from Black Fox Security: ICT risk management gap assessment, incident reporting, digital operational resilience testing and ICT third-party risk.
- Governance and riskSecurity risk assessmentInfrastructure, network and application risk assessment by Black Fox Security: probability versus severity, a risk register your owners use and treatment options.
- Compliance and certificationISO/IEC 27001ISO/IEC 27001 support from Black Fox Security: ISMS scoping, risk assessment, Statement of Applicability, internal audit and certification audit preparation.
Start with the list
Tell us how many suppliers you think you have. We will help you find the rest.