Third-Party Risk Management:
A Practical Checklist for Supplier Risk
Editorial Insight Asset // Supply Chain Threat Model
Most companies discover supplier vulnerability only when a breach notification arrives, a regulator asks for evidence of due diligence, or a critical platform goes offline. A questionnaire is not a program; it is merely paperwork.
A supplier questionnaire is not a risk programme. It is only the beginning of one. The difference between organisations that manage third-party risk effectively and those that do not is not the sophistication of their tools, it is the discipline of their process.
KEY INSIGHT
A supplier questionnaire is not a risk programme; it is only the beginning of one.
VULNSEE, SUPPLY CHAIN RISK MAPPING
Fig., Supply Chain Mapping
The Vendor You Trust Can Still Become Your Exposure
The majority of significant data breaches in recent years did not begin inside the targeted organisation. They began with a supplier, a payroll processor, a software vendor, a managed service provider, a document management firm. The attacker found a weaker link in the chain and used it as the entry point to a business that was, by its own measures, reasonably well-defended.
This is not a new observation. What has changed is the regulatory response to it. The EU's NIS2 Directive explicitly requires documented third-party risk management for organisations in critical sectors. DORA mandates ICT third-party risk frameworks for all financial institutions operating in the EU. The SEC's cybersecurity disclosure rules require public companies to disclose material incidents, including those originating through vendors. ISO 27001:2022 and SOC 2 both treat supplier security as a core certification requirement, not an appendix.
What has also changed is the scale of the problem. Procurement moves faster now. A SaaS tool gets approved on Tuesday, integrated into core workflows by Thursday, and given access to customer data before anyone in security has been asked a single question. That gap, between business speed and security velocity, is where third-party exposure accumulates.
"A supplier questionnaire is not a risk programme. It is the beginning of one. The discipline of ongoing monitoring, contract review, and offboarding is what separates governance from paperwork."
Strategic Assessment
Five Disciplines That Separate Governance from Paperwork
Inventory and Tiering, Know What You Cannot See
Questionnaire and Evidence, Self-Attestation Is Not Assurance
Contract Review, Unenforceable Obligations Protect No One
Continuous Monitoring, The Snapshot Problem
Offboarding, The Access That Outlives the Contract
15 Questions to Ask Every Critical Vendor
Not a generic, automated questionnaire, but the specific, forensic questions that reveal whether a vendor's safety program is credible or merely performative.
Do you hold a current ISO 27001 certification, and when was your last surveillance audit?
Do you have a SOC 2 Type II report available, and can you share it under NDA?
When did you last conduct a third-party penetration test, and can you share the executive summary?
How do you manage access to our data, which of your employees can access it, and how is that access controlled and logged?
What is your breach notification procedure, and within what timeframe would you notify us of an incident affecting our data?
Do you use subcontractors to process our data, and if so, what due diligence do you perform on them?
How do you handle data at contract termination, return, deletion, or destruction, and on what timeline?
What encryption standard do you use for data at rest and in transit?
Do you have a formal vulnerability disclosure or responsible disclosure policy?
Have you experienced a security incident, breach, or ransomware attack in the past 24 months? If so, what changed afterward?
How do you manage privileged access to production systems that contain our data?
Do you have a documented incident response plan, and has it been tested in the past 12 months?
What is your patch management policy for critical vulnerabilities, and what is your target remediation timeline?
Are you subject to any regulatory compliance requirements relevant to our data, and how do you maintain that compliance?
Who in your organisation is the named security contact for issues related to our account, and what is the escalation path?
Executive Briefing
Oversight Responsibility
Third-party risk is not an IT problem, it is a business governance problem. The organisation is accountable for breaches that originate through its vendors, regardless of where the failure occurred. Regulators and enterprise customers increasingly expect documented evidence of supplier oversight.
Immediate Action
Build or formalise a vendor register. Require security assessment as a gate in procurement, not a retrospective exercise. Assign accountability for TPRM, either within the security function or as a shared responsibility with procurement and legal.
Risk Management
If you have Tier 1 vendors with access to sensitive data who have never been formally assessed, that assessment should begin immediately. Not because of regulatory pressure, because the exposure is real, and it is unquantified.
Where Third-Party Risk Programmes Break Down
Treating assessment as a one-time event
A security questionnaire completed at onboarding tells you about a vendor's posture on one particular day. Vendors change their infrastructure, staff, and subcontractors. Ongoing monitoring is what converts a point-in-time snapshot into a genuine risk management programme.
Accepting claims without evidence
A vendor claiming ISO 27001 certification should provide the certificate and certificate number, both verifiable with the issuing body. A vendor claiming SOC 2 compliance should provide the Type II report. Claims without evidence are not assurance.
No offboarding checklist
When a vendor contract ends, access is frequently not revoked promptly. Former vendor accounts that remain active in your IAM system for weeks or months are an unmonitored attack surface, and one that is entirely preventable.
Applying the same scrutiny to all vendors
A vendor managing payroll or processing patient data deserves a materially different assessment standard than one providing office supplies. Tiering allows you to focus diligence effort where the exposure is highest.
Common Questions
What is third-party risk management (TPRM)?
TPRM is the process of identifying, assessing, and managing cyber and operational risks that arise from an organisation's relationships with external vendors, suppliers, and partners who access company data, systems, or infrastructure.
How often should you reassess third-party vendors?
Critical vendors should be reassessed annually at minimum, with continuous monitoring in between. High-risk vendors with access to sensitive data or core systems may require quarterly check-ins and real-time security rating monitoring.
What regulations require a TPRM program?
NIS2, DORA, SEC cybersecurity disclosure rules, ISO 27001, and SOC 2 all explicitly require documented third-party risk management processes. GDPR also mandates data processor due diligence.
What is vendor tiering in TPRM?
Vendor tiering classifies suppliers by risk level, Tier 1 (critical access to sensitive data or core systems), Tier 2 (moderate access), and Tier 3 (low access). This determines how much due diligence each vendor receives and how frequently they are reassessed.
What is the difference between a security questionnaire and a SOC 2 report?
A security questionnaire is self-reported, useful for initial screening but unverified. A SOC 2 report is an independent audit by a licensed CPA firm providing evidence-based assurance of a vendor's security controls. Both are complementary: the questionnaire screens broadly; the SOC 2 report provides depth.
Next Steps
