Security reviews of the suppliers holding your data
A tiered supplier register, questionnaires sized to the risk, evidence checked rather than accepted, and contract clauses that still work when a supplier has a bad day.
- Tiers
- Three, set by the data held and the access granted
- Evidence
- Certificates checked for scope and date; assurance reports read in full
- Framework hooks
- ECC third-party and cloud domain, ISO/IEC 27001 supplier controls, PDPL processors
- Review cycle
- Tier 1 every year, Tier 2 every two years
- Delivery
- Remote
Third-party security assessment checks that the suppliers who hold your data or reach your systems protect them to the standard you need. We build the supplier register, tier suppliers by what they touch, send questionnaires sized to each tier, check the evidence behind the answers and write the contract clauses.
- 01 Call
- 02 Scope
- 03 Read
- 04 Register
- 05 Documents
- 06 Plan
Security reviews of the suppliers holding your data sits at step 4 of how an engagement runs. You receive the register.
The questionnaire problem
A spreadsheet of several hundred questions goes to every supplier, including the stationery company.
The answers come back "yes" throughout. An ISO 27001 certificate is attached, and nobody notices that its scope covers the supplier's head office, not the data centre where your data sits. The spreadsheet is filed.
Meanwhile the IT support company that holds administrator access to your whole domain gets the same form as the caterer. The risk is concentrated in a handful of suppliers, and the effort should be too.
Tier by what they touch
In most organisations Tier 1 is a short list. That is where the work goes.
| Tier | Who usually lands here | What we ask for |
|---|---|---|
| Tier 1 | Administrator or remote access to your systems, or bulk or sensitive personal data: IT support, payroll, cloud hosting, software vendors with remote support. | The full questionnaire, evidence for key answers, a certificate scope check, the latest test summary, incident history, and a call with their security lead. |
| Tier 2 | Some of your data, or an occasional connection. | A short questionnaire and a certificate check. |
| Tier 3 | No data and no access. | A standard contract clause, nothing more. |
What you hold at the end
The supplier register
Every supplier that touches data or systems, tiered, with the reason for each tier written beside it.
A questionnaire per tier
Sized to the tier, so the caterer is not sent the IT support company's form.
Tier 1 assessment records
One per Tier 1 supplier, listing the evidence seen, not only the answers given.
The findings and follow-up log
Each finding with the deadline agreed with that supplier.
The contract security schedule
Clauses for Tier 1 and Tier 2 contracts, for your lawyer to finalise.
The review calendar
When each supplier is next assessed, and the events that bring a review forward.
From register to contract
- 01
Build the register
From accounts payable and the access lists held by IT, so no supplier is missed because nobody remembered it.
- 02
Tier each supplier
By the data it holds and the access it has, with the reason recorded.
- 03
Send the questionnaires
One per tier, sized to it. Tier 3 gets a clause, not a form.
- 04
Check the evidence
Certificates for scope and date, assurance reports read in full, test summaries for what was tested and retested.
- 05
Write the contract schedule
Breach notice to you within hours, short enough for you to meet your own obligations, such as SDAIA's 72-hour clock if you are in Saudi Arabia; your right to request evidence; approval before they subcontract; where your data may be held; return and deletion when the contract ends. Assessments go out of date. Clauses do not.
- 06
Keep it current
An annual cycle for Tier 1, every two years for Tier 2. Out of cycle when a supplier is in the news for a breach, changes ownership, or starts touching more of your data than it did.
Sixty suppliers, four that matter most
A distribution company has about sixty active suppliers and a customer audit asking how it controls suppliers with access to its systems.
The register is built from accounts payable and the IT contractor's access list. Seven suppliers touch data or systems: the IT support company, the payroll bureau, the cloud ERP, the CCTV contractor with remote access, the website agency, a courier with an API connection, and a recruitment agency. Four are Tier 1.
The IT support company's answers reveal a single administrator account shared by its technicians across clients, which becomes a finding with a deadline. The CCTV contractor's remote access has no expiry, and is set to expire. The payroll bureau's certificate scope is checked and found to cover the right site. At renewal, each Tier 1 contract gets the security schedule.
The company holds the register, four Tier 1 assessments, three Tier 2 records, a findings log and a clause schedule its lawyer has approved.
Reading the evidence properly
An answer is a claim. Each kind of evidence behind it has its own trap.
Scope, sites and expiry
Check who issued the certificate and whether that body is accredited, the scope statement, the sites covered and the expiry date. A certificate with the wrong scope is not evidence for your data.
The section about you
For an assurance report such as SOC 2, check whether it covers a period of operation or a single date, what is carved out, and the section listing what the customer must do. That section is about you, and most readers skip it.
Date, scope and retest
Check the date, what was in scope, and whether the findings were retested. A summary of a test from years ago, on a different system, tells you little about the one holding your data.
They publish, they do not answer
Large cloud providers will not answer your questionnaire. They publish assurance material instead, and the assessment reads that and records which of your responsibilities it leaves with you.
What procurement and compliance leads ask
Can you audit a supplier on site?
With the supplier's agreement, yes, as a review of documents, processes and interviews. ITF Consult runs second-party audits of suppliers against broader requirements. Testing a supplier's systems is not part of it.
What if a supplier refuses to answer?
That is itself a finding. We record it, and the decision whether to keep the supplier, add a contract clause or limit its access is yours.
Do you use a software platform?
You receive the register as a file you own. If you later want it in a system, ITF Digital can build one, or you can use a product.
How does this help with the PDPL?
A supplier that processes personal data for you is a processor under the PDPL. The register shows which suppliers those are, and the schedule carries the clauses your processing agreements need.
What drives the cost?
How many suppliers reach Tier 1, how complete your supplier records are, and whether contract clauses are drafted for existing contracts or only at renewal.
Connected work
Security policies and governance
The supplier security policy this register puts into practice.
Read moreSaudi regulationPDPL readiness
Processors, processing agreements and the 72-hour breach notice.
Read moreSaudi regulationNCA ECC readiness
The third-party and cloud domain of ECC-2:2024, answered from the same register.
Read moreITF ConsultSupplier and contractor audits, ITF Consult
A supplier audited on site against your own requirements, with a scored report.
Read moreITF FMVendor management, ITF FM
The contractors on your site in one register, with their documents and expiry dates visible.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Start with the suppliers who hold the keys
We build the register from your accounts payable and access lists, tier it, and show you which suppliers carry the risk.