Has your organization established formal criteria for determining supplier criticality based on data sensitivity, system access levels, and business impact?

This question assesses whether your organization has a structured approach to categorizing suppliers based on risk factors. Effective supplier criticality criteria should consider what sensitive data suppliers can access, their level of access to your systems, and how essential their services are to your core operations. Without such criteria, organizations may apply inconsistent security controls across their supplier ecosystem, potentially leaving critical vulnerabilities unaddressed. Evidence of compliance could include a documented supplier classification framework, risk assessment matrix, or tiered supplier management policy that clearly defines criticality levels and corresponding security requirements for each tier.