GRC · Specialist service
Supplier and supply chain security audits
Service security also depends on the partners entrusted with your data and processes. We assess third-party risks according to supplier criticality and the available evidence.
Service scope
Supplier security
We establish or improve assessments of IT, cloud, software and other important suppliers. The scope reflects access, data and the business impact of disruption. We analyse supplied documentation, responses and evidence of control operation, and conduct further interviews or checks where access is agreed. We distinguish verified facts from supplier declarations and identify assessment limitations. Findings support engagement decisions and subsequent reviews.
Classifying the relationship
We establish service criticality, data types, access and dependencies. We select the assessment scope and criteria for accepting supplier risk.
Verifying security controls
We review evidence relating to access, data protection, changes and incident handling. We verify the scope of the certificates and reports provided.
Continuity and responsibilities
We analyse dependencies, subcontractors, recovery and emergency communications. We identify client and supplier obligations and areas requiring clarification.
Recommendations and oversight
We prepare a risk assessment, engagement requirements and a remediation plan. We establish review dates and the evidence needed to close findings.
Project deliverables
What will your team receive?
- Supplier profile and rationale for the assessment scope.
- Report with evidence, findings and limitations.
- Risk assessment and engagement recommendations.
- Action plan and reassessment schedule.
Delivery conditions
What do we agree before starting?
- Description of the service, data, access and supplier criticality.
- Agreed assessment rights and access to relevant evidence.
- Involvement of the client’s relationship owner, procurement and legal teams.
How we work
From understanding the need to verifying the result.
Establish supplier criticality
We describe dependencies and engagement risks, selecting criteria and a proportionate assessment scope.
Analyse the evidence
We review materials and clarify gaps, confirming which services and locations the documents cover.
Agree the next steps
We deliver the assessment, requirements and open issues. We support planning of reviews and verification of recommendations.
Clear responsibilities
What is already included, and what do we extend?
A comprehensive supplier security assessment is a GRC service. Routine supplier escalations during SOC/NOC incidents and Enterprise reporting remain part of the relevant operational services.
Before making a decision
Questions about supplier security
Is a supplier certificate enough for a positive assessment?
It is important evidence, but its scope and relevance to the purchased service must be checked. It does not replace assessment of the specific relationship or division of responsibilities.
What if a supplier does not provide all the evidence?
We document the limitations and resulting uncertainty. Alternative evidence or engagement terms may be considered; acceptance of the residual risk remains with the client.
Do you also assess the supplier’s subcontractors?
We account for their significance and available information within the agreed scope. Direct assessment of additional organisations requires appropriate access and authorisation.
Related expertise
Connect activities that complement each other.
The next step
Let us define a scope that makes sense for your organisation.
Let us discuss your environment, priorities and team responsibilities. We will use this to define the work, required access and service conditions.