Skip to content

Supply Chain & Resilience

Supply chain trust assurance

What this is

Supplier assurance is the verification that critical third parties meet the security requirements an organisation depends on. Evidence-based assurance goes beyond questionnaires by checking certificates are current and in scope, reading audit reports rather than filing them, testing specific control claims, and putting enforceable requirements into contracts.

The problem

You have four hundred questionnaire responses and no assurance.

A questionnaire tells you what a supplier says about itself, usually written by someone commercial, on a date that has passed. It is a reasonable screening tool. It is not evidence, and treating it as evidence produces a large body of documentation that answers nothing when a supplier is actually breached.

The specific gap is verification. A supplier attaches an ISO 27001 certificate; nobody checks whether the scope statement on it covers the service you buy, or whether the certificate is still current, or whether the certification body is accredited. A supplier says they penetration test annually; nobody asks to see the last report or the remediation status. Each check takes minutes and almost nobody does them.

Regulators have moved on this. DORA requires documented due diligence, specific contractual provisions and exit strategies for critical ICT providers. NIS2 and the UK Cyber Security and Resilience Bill push in the same direction. Collected attestations are no longer a defensible position for a critical dependency.

Who this is for

  • Financial entities in scope of DORA, which has applied since 17 January 2025.
  • Organisations whose supplier assurance is a questionnaire archive nobody reads.
  • Companies that discovered during an incident that they did not know what a supplier could reach.
  • Firms whose customers now audit their supplier management as part of their own assurance.
  • Procurement teams who need security requirements that survive contract negotiation.

Delivery

How the engagement actually runs

Sprints inside your engineering cycle, with findings arriving continuously rather than a report arriving at the end. Durations are elapsed time for a typical scope, and get re-scoped against your estate before anything is committed.

  1. 011-2 weeks

    Establish the population

    The real supplier list from procurement, finance and SSO - not the approved vendor list, which is always shorter than reality.

  2. 021 week

    Tier and prioritise

    Tier by impact of failure. Tier 1 gets evidence-based assessment; lower tiers get proportionate screening.

  3. 034-8 weeks

    Assess tier 1

    Verification against evidence, supplier by supplier. Findings delivered as they land, because a critical finding should not wait for the programme to finish.

  4. 04Ongoing

    Contract and monitor

    Security schedules into contracts at renewal, monitoring on tier 1, and reassessment triggered by change rather than by calendar alone.

Deliverables

What you actually receive

Artefacts your team owns and can maintain after the engagement, not a report that ages the moment it lands.

Deliverables for Supply chain trust assurance, with what each one contains and when it lands
DeliverableWhat it containsWhen
Tier 1 assessment programmeEvidence-based assessment of critical suppliers: certificate scope and currency verified, audit reports read, penetration test results reviewed, specific claims tested.Sprint 2-4
Certificate verificationEvery claimed certification checked for currency, accreditation of the issuing body, and whether the scope statement actually covers the service you buy. This alone changes several positions.Sprint 2
Security schedule for contractsEnforceable terms procurement can actually use: notification windows, audit rights, sub-processor change control, security requirements and exit provisions.Sprint 3
Assessment methodologyA repeatable process your team runs, tiered by criticality, so new suppliers are assessed proportionately rather than uniformly.Sprint 4
Findings and risk decisionsWhere suppliers fall short, what compensating controls exist, and a recorded decision by a named person on each residual risk.Sprint 4
Ongoing monitoringContinuous signal on tier 1 suppliers so a change in posture surfaces between assessments rather than at the next one.Ongoing

Frameworks this touches

FAQ

Questions people actually ask

What should we check on a supplier's ISO 27001 certificate?

Four things, all quick and all frequently skipped. That the certificate is current rather than expired. That the certification body is accredited by a recognised national accreditation body such as UKAS, because unaccredited certificates exist and mean much less. That the scope statement covers the specific service you buy, not a different part of the supplier's business. And that the Statement of Applicability does not exclude controls you are relying on.

What security terms should be in a supplier contract?

At minimum: a breach notification window expressed in hours with a defined trigger, the right to audit or to receive assurance evidence, control over sub-processor changes with a notice period, specific security requirements proportionate to what the supplier holds, data location and return or deletion on exit, and an exit assistance obligation. Regulated organisations under DORA have a longer prescribed list.

How often should critical suppliers be reassessed?

Annually for tier 1 as a floor, and on change regardless of the calendar. Change means a material incident at the supplier, a change of ownership, a significant change in the service or its architecture, a sub-processor change, or the expiry of a certification they claimed. Calendar-only reassessment means a supplier who was acquired in February is next examined in November.

What do we do about a critical supplier who will not engage?

Record it as an accepted risk with a named owner, and treat that as a live position rather than a filing. Some critical suppliers are large enough not to answer questionnaires and will point to published assurance instead - which is often genuinely sufficient if you read it. Where a supplier neither engages nor publishes, the honest position is that the risk is unverified, and the questions become what compensating controls you hold and how substitutable they are.

More in Supply Chain & Resilience

Start

Three ways in, depending on how close the deadline is.

Or just email a human: hello@cloudgap.ai

We reply within24 hours