Supplier assurance · Evidence based, ten days
Supplier AI & Cyber Risk Assessment: your critical suppliers verified in ten days
An evidence based supplier cyber risk assessment of the vendors your business depends on: up to ten critical suppliers tiered by what they could break, security and AI claims verified against real evidence rather than questionnaire answers, contracts read for the clauses that matter, and a board ready risk register on day ten. From £8,500 + VAT, fixed before work starts.
The assessment at a glance
Definition
What is a supplier cyber risk assessment?
A supplier cyber risk assessment is an evidence based review of the suppliers your business depends on: each one tiered by what it could break, its security and AI claims verified against real evidence rather than questionnaire answers, its contract checked for the clauses that matter, and the findings written so a board, customer or auditor can act on them.
Intelance delivers the portfolio assessment in ten working days from £8,500 + VAT, covering up to ten critical suppliers, with larger portfolios priced per supplier in writing. The distinctive part is verification: certificates are checked at source for scope and expiry, security is tested from the outside, and supplier AI use is examined rather than assumed, because suppliers have quietly become AI companies under terms that changed with an update.
Around the assessment sits a complete practice: the single supplier review, the framework your team owns, and the function run monthly. Assessing supplier AI for the first time? Our guide to assessing supplier AI risk covers the method.
Tiered by exposure
Effort follows what each supplier could break.
Claims verified
Certificates, controls and promises checked against evidence.
Contracts read
Breach notice, audit rights, data return and AI clauses confirmed.
AI examined
What supplier AI does with your data, as standard.
The risk map
Six places supplier risk hides
Questionnaires cover none of these properly. Each card says what gets examined and what lands in your register.
What they can reach
Credentials, VPNs, API keys and integrations into your systems: the access map nobody maintains.
OutputAn access register per supplier, with the forgotten doors flagged.What they hold
Your data sitting in their systems: what, where, why, and whether anyone agreed to it.
OutputA data held map per supplier, tiered by sensitivity.What their AI does
AI features switched on in their products, your data in their training pipelines, terms that changed quietly.
OutputA supplier AI register: the blind spot questionnaires never cover.Where it concentrates
Single points of failure, shared platforms behind multiple vendors, the fourth parties behind your third parties.
OutputA concentration map: what one outage would take down.Whether claims are true
Certificates checked for expiry, scope and truth: a Cyber Essentials badge covering one office is not cover.
OutputA verified evidence file: claimed against real, per supplier.What the contract says
Breach notification, audit rights, data return and AI clauses, read in the actual contract.
OutputA contract gap list, ready for your counsel to act on.How it works
What happens in the ten working days
Fixed scope by design: up to ten critical suppliers, assessed properly, with the register in your hands on day ten.
Scope and tiering
The supplier list agreed, each one tiered by what it could break: what they can reach, what they hold, and what stops if they stop.
Evidence collection
Certificates pulled and verified at source, security checked from the outside, contracts read, AI features and terms examined.
Verification and scoring
Claims tested against findings, gaps scored by what they could break, and every fix costed: contractual, technical or replace.
Validation
Findings validated with your team before anything is written down, so the register lands as recognition rather than accusation.
The register and readout
The supplier risk register walked through, board ready, with the fixes sequenced and priced. Yours to act on, with anyone.
Supplier risk does not stay assessed: suppliers change, certificates lapse and AI terms move. The Supplier Assurance Office keeps the register current month by month from £3,500 + VAT, and independent assurance is available when a board or customer needs proof.
Published fees
What sits around this assessment
Every service has a published fee and a defined output. They stand alone or run in sequence.
Supplier Assurance Review
One supplier examined deeply: access, data, certificates, contract and AI use, with a written verdict.Best whenA single supplier worries you, or a renewal is forcing a decision. FeeFrom £4,500 + VAT / supplier 02Supplier Assurance Framework
The way your company checks suppliers, built once and owned by you: tiering, question sets, evidence standards and a register in your own tools.Best whenThe checking should live in your own team. FeeFrom £14,500 + VAT4 to 6 weeks 03
Supplier Assurance Office
The supplier checking function run for you monthly: the front door, renewals, certificates and the register kept current.Best whenSuppliers change faster than anyone in-house can track. FeeFrom £3,500 + VAT / month 04Virtual Security Office (vSCARO)
The whole security function run monthly, with supplier assurance one part of it.Best whenThe gap is wider than suppliers. FeeFrom £7,500 + VAT / monthThe alternatives
How the assessment compares with the alternatives
Three ways organisations answer the supplier question. The difference is whether anything is verified.
The same forty questions to every supplier, answered by the people being assessed
A folder of optimistic answers nobody reads
Effort spread evenly across suppliers that matter and suppliers that do not
Weeks of chasing, nothing verified
Deep single-supplier checks, commissioned name by name as worries surface
The truth about one supplier, with the rest still unknown
The register never exists, so the board question never gets a full answer
From £4,500 + VAT per supplier, as needed
Up to ten critical suppliers tiered, verified and registered in ten working days, from £8,500 + VAT
The whole critical portfolio: access, data, AI, concentration, claims and contracts, verified
Ten suppliers is the fixed scope. Deeper single-supplier questions escalate to the review
10 working days, from £8,500 + VAT
Scope
Inside the scope and outside it
You get
A supplier risk register covering up to ten critical suppliers, tiered by what each could break.
Verified evidence per supplier: certificates checked at source, security tested from the outside.
A supplier AI register: what their AI does with your data, under which terms.
A concentration map and contract gap list, ready for your counsel to act on.
Every fix costed and sequenced: contractual, technical or replace, walked through board ready on day ten.
This is not
A questionnaire exercise. Suppliers are rarely contacted, and never with forms. The evidence is verified instead.
A penetration test of your suppliers. Posture is checked from the outside. Nobody attacks anybody’s systems.
A one-off answer. Suppliers change and terms move. The register is built to be kept current, by your team or the Office.
A software platform. The register lives in your own tools. No portal, no licence, no vendor commission.
Where to start
Where this usually starts
Four situations we are usually called into. If none of them fit, speak to us and we will point you at the right first step.
Why Intelance
The rules we work to
Evidence is verified
Certificates checked at source for scope and expiry, security tested from the outside, contracts read in full. Claims are where we start, and never where we stop.
Tiered so effort follows exposure
The supplier that holds your customer data gets the deep look. The stationery supplier does not.
AI examined as standard
Every assessment produces a supplier AI register, because the blind spot questionnaires never cover is where the new incidents start.
Priced in writing before we start
From £8,500 + VAT for up to ten critical suppliers, with larger portfolios priced per supplier before work starts.
We sell advice and nothing else
No portal, no licences, no vendor commission. The register lives in your own tools and the fixes can go to anyone.
Who runs the work
Engagements are led by a senior partner and delivered by senior reviewers who pull and verify the evidence themselves, with established associates across cyber, AI and data governance where depth is needed.
Supplier assurance guides
All insights
CybersecurityHow to answer customer security questionnaires (without losing a week)
The questionnaire lands mid deal and eats a week. How to answer it in a day instead: the evidence pack, what the reviewer on the other side wants, the certifications that pre-answer whole sections, and when to make it someone's job.
9 July 2026 · 6 min read Read the guide
Supplier AssuranceHow to assess supplier AI risk (before it becomes an incident)
9 July 2026 · 6 min read
Cyber EssentialsCyber Essentials vs ISO 27001 vs IASME Cyber Assurance: which do you need?
9 July 2026 · 6 min read
Cyber EssentialsCyber Essentials questionnaire guide: how to answer every question (UK 2026)
24 March 2026 · 14 min readReady to talk?
Tell us who your critical suppliers are
Thirty minutes with a senior reviewer: which suppliers hold your data, who can reach your systems and what raised the question. If nobody can name the ten that matter, that is the first thing the assessment fixes.
FAQs
Questions about the supplier risk assessment
What is a supplier cyber risk assessment?
An evidence based review of the suppliers your business depends on: each one tiered by what it could break, its security and AI claims verified against real evidence rather than questionnaire answers, its contract checked for the clauses that matter, and the findings written as a register a board, customer or auditor can act on.
What does a supplier risk assessment cost in the UK?
With Intelance, the portfolio assessment covers up to ten critical suppliers from £8,500 + VAT in ten working days, with larger portfolios priced per supplier in writing. A single supplier review runs from £4,500 + VAT, the assurance framework is built from £14,500 + VAT, and the office runs the function from £3,500 + VAT a month.
Does Intelance contact suppliers directly during an assessment?
Rarely, and never with questionnaires. Most of the assessment is done from evidence: certificates verified at source, security checked from the outside, contracts read and AI terms examined. Direct supplier contact is agreed with you first and kept specific.
Why does supplier AI risk matter now?
Suppliers have quietly become AI companies: licensed products now carry AI features, sometimes trained on customer data, under terms that changed with an update nobody read. Every Intelance assessment produces a supplier AI register, because this is the blind spot questionnaires never cover.
How is verified supplier assurance different from questionnaires?
Questionnaires collect claims, written by the people being assessed. Verified assurance tests them: certificates checked for scope and expiry, controls tested from the outside, contract clauses read in the actual contract. The output is a register of verified facts tiered by exposure rather than a folder of answers.
What is the difference between a supplier risk assessment and a third party risk assessment?
The labels overlap: third party risk assessment is the broader industry term and usually implies an ongoing portfolio process. The Intelance assessment is the evidence based starting point of that process, and the framework and office turn it into a standing capability.
What is the difference between the framework and the office?
The framework is built once and owned by you: tiering rules, question sets, evidence standards and a register in your own tools. The office is the same function run for you month by month by named senior people, with a designed handover whenever you want it in-house.
Who runs the work on an Intelance supplier assurance engagement?
Engagements are led by a senior partner and delivered by senior reviewers who pull and verify the evidence themselves, with established associates across cyber, AI and data governance where depth is needed. Nothing is offshored.