How do we…
How do we check a supplier's evidence rather than trusting their questionnaire answers?
Add to board memoOpen the memo
The short answer
- Recommendation
- Send the tier's evidence request with the questionnaire, then validate each item before you rely on it: its scope covers the service you buy, it is in date, and it is issued to the company you contract with. An item that fails a check counts as not received and becomes a finding.
- Reasoning
- Questionnaire answers are the supplier's own account of itself. Evidence shows whether they describe the service you buy. A certificate for a head office or one product says nothing about the data centre that runs your service, and groups often hold a certificate in one company's name and sign contracts in another's. For an audit report or a test, the opinion and every exception matter more than the cover page. An answer the evidence does not support is not met. The decision then follows from the findings; the number of items that passed does not decide it.
- Considerations
- The 12-month validity for reports and tests, the 3-month gap before a bridge letter is needed and the finding deadlines (High 90 calendar days, Medium 180) are the pack's defaults. Your own procedure may set different ones.
- Each item has an accepted alternative: a certification for an audit report or the reverse, and at Tier 2 key policies with evidence they operate. Where none exists, the missing item is itself a finding.
- With no completed questionnaire there is no assessment. If the supplier refuses it, the business owner's decision can only be Reject or Escalate. Late evidence goes to the business owner, then the Head of Information Security.
- Where the supplier delivers the service through its own providers, such as cloud hosting, check that the evidence covers their part too.
The decision, step by step
Select any step for the reasoning behind it and where the pack covers it.
- Start
- Step
- Decision
- Outcome
Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.
Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.
Read as text
The same flow written out: each step, its reasoning and where the pack covers it. 15 steps.
Start
The tier is known and the questionnaire is going out
The questionnaire answers will be the supplier's own account of itself. Warning signs are 'Yes' to everything with no detail, answers copied from marketing material, and answers about a parent company or a different product. Evidence is how you find out whether the answers describe the service you buy.
In the pack
- P06-A06 Supplier Due Diligence Evidence ChecklistEvidence Items
Step
Ask for the tier's evidence, sent with the questionnaire
Tier 1: independent assurance (a certification with a matching scope, or an audit report), a recent penetration test summary and continuity test results. Tier 2: a certification or independent report, or key policies with evidence they operate. Tier 3: a self-declaration, with a sample of its answers, 3 in the pack's default, checked against evidence. Tier 4: nothing beyond the intake answers. Ask for extra items only where an answer depends on them or you doubt it.
In the pack
- P06-A03 Supplier Security Assessment ProcedureStage 4 — Evidence
- P06-A06 Supplier Due Diligence Evidence ChecklistInstructions
Decision
Has each requested item arrived?
Take the items one at a time. A supplier may say an item does not exist, which is different from refusing to take part. Remind the supplier before its deadline, and tell the business owner if nothing arrives by then.
- Yes: Does its scope cover the service you buy?
- Not available: Does an accepted alternative exist?
- Supplier refuses to take part: Escalate to the business owner: no assessment without answers
In the pack
- P06-A03 Supplier Security Assessment ProcedureStage 3 — Questionnaire
- P06-A06 Supplier Due Diligence Evidence ChecklistSupplier Checklist
Outcome
Escalate to the business owner: no assessment without answers
There is no assessment without a completed questionnaire. If the supplier refuses to answer it, take it to the business owner: the decision can then only be Reject or Escalate. If evidence does not arrive by the deadline, tell the business owner, then the Head of Information Security.
In the pack
- P06-A06 Supplier Due Diligence Evidence ChecklistEvidence Items
- P06-A03 Supplier Security Assessment ProcedureEscalation
Decision
Does an accepted alternative exist?
Each evidence item has a fallback. A certification can stand in for an audit report and the reverse; at Tier 2, policies with evidence they operate also count. A screenshot or extract can replace a patch report. Where no alternative exists, the missing item is itself a finding. For access evidence the pack is blunt: a supplier that cannot show who reaches your data does not control it.
- Yes: check the alternative: Does its scope cover the service you buy?
- No: Raise a finding with a severity and deadline
In the pack
- P06-A06 Supplier Due Diligence Evidence ChecklistEvidence Items
Decision
Does its scope cover the service you buy?
Read the scope statement, not the logo. A certificate for a head office or one product says nothing about the data centre that runs your service. Check that it names the service, sites and teams you rely on. Where the supplier uses its own providers to deliver the service, such as cloud hosting, check the evidence covers their part too.
- Yes: Is it in date?
- No, or not known: Treat the item as not received
In the pack
- P06-A06 Supplier Due Diligence Evidence ChecklistEvidence Items
- P06-A03 Supplier Security Assessment ProcedureStage 4 — Evidence
- P06-A07 Supplier Contract Security Clause LibraryCL-02 Certification and independent assurance
Decision
Is it in date?
A certificate must be valid and not suspended. In the pack's defaults, an audit report period and a penetration or continuity test must fall within the last 12 months. An audit report whose period ended more than 3 months ago also needs a bridge letter covering the gap.
- Yes: Is it issued to the company you contract with?
- Report period ended over 3 months ago: Ask for a bridge letter to cover the gap
- No: Treat the item as not received
In the pack
- P06-A03 Supplier Security Assessment ProcedureStage 4 — Evidence
- P06-A06 Supplier Due Diligence Evidence ChecklistEvidence Items
Step
Ask for a bridge letter to cover the gap
A bridge letter is signed by the supplier's management and says whether the controls in the report have changed or failed since its period ended. Read any change it declares and follow it up. A gap longer than 12 months means the report is out of date: look for other assurance.
In the pack
- P06-A06 Supplier Due Diligence Evidence ChecklistEvidence Items
Decision
Is it issued to the company you contract with?
Groups often hold a certificate in one company's name and sign contracts in another's. Evidence issued to a parent, sister or subsidiary company may not cover the one on your contract. For a certificate, also check the certification body is itself accredited.
- Yes: Does it show a failure or open gap that affects you?
- No, or not known: Treat the item as not received
In the pack
- P06-A06 Supplier Due Diligence Evidence ChecklistEvidence Items
- P06-A02 Third-Party Security PolicyAssessment and decision (rule TP-04)
Decision
Does it show a failure or open gap that affects you?
For an audit report or a test, read the opinion and every exception, not just the cover page. Warning signs: a qualified opinion, exceptions in access control or change management, a report on control design at a single date, serious test findings with no fix date. Note the controls the report expects you to run yourself; they are yours to operate.
- Yes, or not read: Raise a finding with a severity and deadline
- No: Does the evidence support the questionnaire answers?
In the pack
- P06-A06 Supplier Due Diligence Evidence ChecklistEvidence Items
Decision
Does the evidence support the questionnaire answers?
Compare what the supplier said with what the evidence shows. An answer the evidence does not support is not met. In the pack's worked example, the user list a supplier sent showed accounts shared by depot staff, so access to customer addresses could not be traced to a person. That became a finding.
- Yes: Record the item as validated, with who checked it
- No, or only partly: Raise a finding with a severity and deadline
In the pack
- P06-A05 Tiered Supplier Security QuestionnaireInstructions
- P06-A06 Supplier Due Diligence Evidence ChecklistInstructions
Step
Treat the item as not received
Evidence that fails a check is not accepted, however official it looks. 'Certificate received' is a common reason a review report is sent back: it says the file arrived, not that it covers the service.
In the pack
- P06-A09 Supplier Security Review Report TemplateField guidance
- P06-A09 Supplier Security Review Report TemplatePart D — Evidence reviewed and how it was validated
Step
Raise a finding with a severity and deadline
Write the gap and the risk it leaves in a sentence the business owner understands. In the pack's defaults, a High finding could directly cause a significant incident or data loss and is due in 90 calendar days; a Medium finding weakens a control that has other protection and is due in 180 calendar days; a Low finding is tracked to the next assessment.
In the pack
- P06-A09 Supplier Security Review Report TemplateFinding severity and deadlines
- P06-A09 Supplier Security Review Report TemplatePart E — Findings
Step
Record the item as validated, with who checked it
Record for each item the date or period, whether scope and legal entity match, the result, who validated it and when. Keep the evidence itself with the record. The report says what was checked; the evidence shows it.
In the pack
- P06-A09 Supplier Security Review Report TemplatePart D — Evidence reviewed and how it was validated
- P06-A09 Supplier Security Review Report TemplateSteps
Outcome
Take the results into the review report and decision
When every item is validated, covered by another, or turned into a finding, write the review report. The residual risk and the decision follow from the findings, not from the number of items that passed. The business owner signs the decision.
In the pack
- P06-A06 Supplier Due Diligence Evidence ChecklistReview Summary
- P06-A09 Supplier Security Review Report TemplateChoosing the decision
Practical checklist
- Send the tier's evidence request with the questionnaire, so both arrive together.
- Note each item as it arrives, and remind the supplier before its deadline.
- Check that each item's scope names the service, sites and teams you rely on.
- Check the dates: certificate valid and not suspended, audit period and tests within 12 months, and a bridge letter where a report period ended over 3 months ago.
- Check that it is issued to the company on your contract, and that a certification body is itself accredited.
- Read the opinion and every exception in each report or test, and note the controls it expects you to run yourself.
- Compare the evidence with the questionnaire answers, and raise a finding with a severity and deadline for every gap.
- Record who validated each item and when, and keep the evidence with the record.
Evidence to have ready
- The completed evidence checklist: for each item, its date or period, whether scope and legal entity match, the result, who validated it and when (TP-04).
- The evidence itself, kept with the review record.
- Each finding, with the gap and the risk it leaves, its severity and its deadline.
- The review report with the decision signed by the business owner (TP-05).
Assumptions
- The supplier has already been tiered, so you know which evidence to ask for.
- The validity periods and finding deadlines shown are the defaults in the CISO Times third-party pack. Your own procedure may set different ones.
Not covered here
- How much assurance to ask for in the first place. That is “How do we decide how much assurance a supplier needs?”.
- What to do when a supplier fails but the contract is already signed. That is “If a supplier fails assessment but the business has already signed, then what?”.