All services Every engagement has a fixed, published price. Book a strategy call
How to tier suppliers by harm, verify evidence instead of assertions, secure the right contract terms, and monitor continuously without a dedicated team.
Most supplier cyber risk work in the UK produces a folder of completed questionnaires and no reduction in risk. Suppliers describe their controls, somebody files the answers, and the exercise repeats a year later. Nothing in that process would have caught the supplier who was breached last month, because nobody verified anything and nobody looked again after the contract was signed.
This guide sets out how to vet a supplier properly and how to keep watching afterwards, sized for organisations without a dedicated third party risk team. It covers tiering by harm, the evidence that means something, the seven questions worth asking, the contract clauses to insist on, and a monitoring rhythm that takes hours a month rather than weeks. Intelance sells supplier assurance, so read it accordingly. The method works whether you run it yourself or not.
The short answer. Rank suppliers by the harm they could cause rather than by what you spend with them. Ask the top tier for evidence instead of assertions: current certificate scopes, a recent penetration test summary, named incident contacts and a subprocessor list. Verify what is publicly checkable before you accept the rest. Put notification, evidence rights and deletion on exit into the contract. Then monitor continuously with a monthly release and breach sweep, an annual re-verification of the top tier, and reassessment triggered by material change. Reviews commonly start from £4,500 + VAT for one supplier.
A questionnaire collects claims. Assessment verifies them. That distinction explains most supply chain incidents that surprised the customer, and it produces four specific failures worth naming.
The NCSC supply chain security guidance makes the same point in more measured language. Know who you depend on, set proportionate expectations, and check them.
Start with a list of every supplier that holds your data, connects to your systems, or would stop your operation if it failed. Then tier by what happens if that supplier is compromised, ignoring contract value entirely.
| Tier | What puts a supplier here | What that tier gets |
|---|---|---|
| Critical | Holds personal or commercially sensitive data at volume, has privileged access to your systems, or your operation stops without it | Full verification before contract, annual re-verification, contract clauses, named relationship owner |
| Important | Holds some data or has limited access, and disruption would be painful rather than fatal | Evidence review before contract, certificate and breach monitoring, reassessment on material change |
| Routine | No sensitive data, no system access, easily replaced | Baseline expectation such as Cyber Essentials where proportionate, and nothing more |
Most organisations find the critical tier is smaller than expected, often ten to twenty suppliers, which is what makes real verification affordable. The uncomfortable discovery is usually a low cost tool nobody procured formally sitting in the critical tier.
For every critical supplier, request six things. Each one is a document or a fact, and none of them is an opinion about the supplier’s security posture.
| What to request | What to look for when it arrives |
|---|---|
| Certificate and scope statement | Read the scope rather than the logo. ISO 27001 certificates name what is covered, and the service you buy is often outside it. Check the certification body and the expiry date. |
| Penetration test summary | A recent test by an independent party, with confirmation that high severity findings were fixed and retested. A summary is enough. A refusal to share any summary is informative. |
| Subprocessor list | Who else touches your data. This is where fourth party risk lives, and where most organisations discover a dependency they never approved. |
| Incident contacts and process | A named route to reach a human out of hours, and a stated notification timescale. Test the route before you need it. |
| Access and offboarding practice | How supplier staff access your environment, whether accounts are individual, and how quickly leavers lose access. |
| Backup and restore evidence | Whether restores are tested and when the last successful test happened. Backups nobody has restored are an assumption. |
For smaller suppliers, Cyber Essentials is a proportionate baseline that answers the basic hygiene questions without a full audit. Certification is verifiable on the IASME register, so it can be checked rather than trusted. Our comparison of the three main UK certifications explains which one to expect from which kind of supplier.
A surprising amount can be confirmed in under an hour per supplier, before you rely on anything they told you.
If you are on the receiving end of questionnaires yourself, our guide to answering security questionnaires covers the same ground from the supplier’s side.
Assessment without contractual force expires the moment the deal is signed. Five provisions carry the weight, and renewal is when you have the leverage to add them.
Continuous monitoring sounds like a platform purchase. For most UK organisations it is a rhythm that fits in a few hours a month.
| Cadence | What happens | Effort |
|---|---|---|
| Monthly | Sweep supplier release notes and news for breaches, ownership changes and new subprocessors across the critical tier | An hour or two, and it catches most of what matters |
| Quarterly | Check certificate expiry dates and chase anything lapsing. Review open findings from previous assessments | Half a day across the estate |
| Annually | Re-verify the critical tier properly, including fresh evidence rather than a repeat questionnaire | The bulk of the work, planned into the year |
| On trigger | Reassess immediately on a breach, an acquisition, a change of data location, or a new subprocessor holding your data | Unplanned, which is why the tier list must be current |
AI has added a category that behaves differently, because supplier features appear without a contract change and often process your data in new ways. Our guide to assessing supplier AI risk covers that specific problem, and it belongs in the same monthly sweep.
Judge the programme against four observable things rather than the number of questionnaires completed.
All of the above can be run internally, and organisations with a capable security lead should consider doing exactly that. Where capacity or independence is missing, the engagements are published.
A Supplier Assurance Review examines one supplier properly from £4,500 + VAT. A Supplier AI and Cyber Risk Assessment tiers your estate and verifies the critical suppliers from £8,500 + VAT. A Supplier Assurance Framework builds the operating model from £14,500 + VAT, and a Supplier Assurance Office runs the function from £3,500 + VAT per month. Every fee is fixed in writing before work starts. The wider practice sits on our cyber, ISO and supplier assurance page, and if the question is a board one, our guide to independent technology assurance for boards explains how to commission it.
It is a structured check of whether a supplier can protect the data and access you give it, based on verified evidence rather than self declaration. A proper assessment tiers the supplier by potential harm, examines certificates, test results and subprocessors, and continues after contract signature through monitoring.
Rank by harm rather than spend. A supplier holding personal data at volume, holding privileged system access, or capable of stopping your operation belongs in the critical tier regardless of contract value. Most organisations find that tier contains ten to twenty suppliers.
Only if the scope covers the service you are buying. Certificates name what is included, and a certificate covering a head office function tells you nothing about the platform holding your data. Read the scope statement and check the certificate is current with the certification body.
Sweep the critical tier monthly for breaches, ownership changes and new subprocessors. Check certificate expiry quarterly. Re-verify the critical tier annually with fresh evidence. Reassess immediately after a breach, an acquisition, a change of data location or a new subprocessor.
Incident notification with a stated timescale, evidence rights during the term, notice of material change including new subprocessors, minimum security expectations proportionate to the tier, and deletion or return of data on exit with a defined format and timescale.
Rarely at first. Tiering, evidence gathering and a monthly sweep can be run from a short register. Platforms earn their place once the supplier estate is large enough that manual tracking stops coping, and by then you will know exactly what the tool has to do.
It is the risk carried by your supplier’s suppliers, such as the hosting provider or the analytics tool inside the service you buy. Ask for the subprocessor list, compare it against the questionnaire answers, and require notice before it changes.
A single supplier reviewed properly commonly starts from £4,500 + VAT. Tiering an estate and verifying the critical suppliers commonly starts from £8,500 + VAT. Running the function as a service is typically bought monthly, from £3,500 + VAT per month.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
