Does your organization conduct formal risk assessments of suppliers that evaluate both business requirements and cybersecurity controls, including supply chain security?

Supplier risk assessments help identify vulnerabilities that could be introduced through third parties who have access to your systems or data.

These assessments should evaluate suppliers against your organization's business requirements (e.g., service level agreements, financial stability) and cybersecurity requirements (e.g., data protection practices, security certifications, incident response capabilities).

Supply chain security specifically examines how components, software, or services provided by suppliers could introduce security risks into your environment.

Evidence of compliance could include documented supplier risk assessment procedures, completed assessment reports for key suppliers, a supplier risk register that tracks findings and remediation plans, or third-party security questionnaires that have been completed and evaluated.