Does your organization perform risk assessments of suppliers against business requirements and cybersecurity standards?

Supplier risk assessments help identify potential security vulnerabilities in your supply chain that could impact your organization's security posture. These assessments evaluate suppliers based on their access to your systems/data, the criticality of their services, and their own security controls implementation against your requirements and industry standards.

Evidence could include a documented supplier risk assessment methodology, completed supplier assessment reports, a supplier risk register showing risk ratings and mitigation plans, or third-party assessment results for critical suppliers.