How do we decide how much assurance a supplier needs?

Start

A new supplier, or a contract up for renewal

Decide the depth of assurance before any questionnaire goes out. The tier comes from what you buy and how you use it, all of which you know on the first day. It measures how much could go wrong, not how good the supplier is, so it never waits for the supplier's answers. Sending every supplier the same long questionnaire means the important ones wait behind the stationery supplier.

• Then: Have the business owner answer the intake questions

Step

Have the business owner answer the intake questions

The manager who buys and relies on the service answers five short questions, with Procurement, before anything is signed: the services it supports, the data it will hold or see, the access it will have, how long a replacement would take, and whether it processes personal data for you or supports a DORA critical or important function. IT confirms the access and the Data Protection Officer confirms personal data. Any answer left blank counts as the most critical, so the person with the facts has a reason to supply them.

• Then: Is it an ICT service for a DORA critical or important function?

Decision

Is it an ICT service for a DORA critical or important function?

This is a legal floor, not a judgement. For a financial entity under DORA, an ICT service supporting a critical or important function is Tier 1 whatever the other answers say. Legal or Compliance confirms the scope. If it is not yet known, apply the floor until it is shown not to apply. Organisations outside DORA answer no.

• Yes, or not known: Tier 1 Critical: deep, independent assurance
• No: Would a critical service stop or degrade if it failed?

Decision

Would a critical service stop or degrade if it failed?

A critical service is one on your own list, such as online ordering, payments or payroll. Count indirect support too: in the pack's example, the carrier that delivers orders supports the dispatch service. Where an answer falls between two anchors, use the higher tier. If you don't know which services depend on it, answer yes.

• Yes, or not known: Tier 1 Critical: deep, independent assurance
• No: Will it hold or reach customer, sensitive or mass personal data?

Decision

Will it hold or reach customer, sensitive or mass personal data?

Judge the data the supplier can reach, not the data it is meant to use. A support provider with administrator access to a customer database holds that data for this purpose. Customer names and delivery addresses count as customer data, so a carrier holding them qualifies. Spend is irrelevant: a free tool can hold all your customer data. If you don't know what it can reach, answer yes.

• Yes, or not known: Tier 1 Critical: deep, independent assurance
• No: Will it have privileged or network access to critical systems?

Decision

Will it have privileged or network access to critical systems?

Count the supplier's people and systems: accounts, remote support tools, network links and integrations. One route into a critical system is enough to cause the harm, so this answer alone can make a supplier Tier 1. A supplier whose portal your staff use, with no route back into your systems, has no access.

• Yes, or not known: Tier 1 Critical: deep, independent assurance
• No: Could it be replaced within 3 months without harm?

Decision

Could it be replaced within 3 months without harm?

How long to move to another supplier or bring the work in house, and what stops meanwhile. The pack's default threshold is 3 months; set yours to the longest outage your critical services can bear. Nobody knows how long a switch takes until they try, so treat an unknown as no.

• No, or not known: Tier 1 Critical: deep, independent assurance
• Yes: Does any answer reach Tier 2, or is it a processor of personal data?

Decision

Does any answer reach Tier 2, or is it a processor of personal data?

Tier 2 anchors: supports an important internal service, holds personal data, has remote user access to your systems, or could be replaced within the threshold only with effort. A processor of personal data is at least Tier 2 by law, whatever the other answers. Four Tier 2 answers stay Tier 2: answers are never added up.

• Yes, or not known: Tier 2 Important: a certificate or report, or policies that work
• No: Is anything at stake at all?

Decision

Is anything at stake at all?

Tier 3 anchors: supports a minor service, holds internal non-personal data, has limited or supervised on-site access, or would take some weeks to replace. Any one of these is enough for Tier 3. Tier 4 is left for suppliers with no service dependency, no data beyond public, no access, and many alternatives.

• Yes, or not known: Tier 3 Standard: self-declaration, with some answers checked
• No, nothing at stake: Tier 4 Minimal: the intake answers are the assessment

Outcome

Tier 1 Critical: deep, independent assurance

In the pack's defaults: the full questionnaire of about 60 questions; independent assurance such as a certification with a matching scope or an audit report, plus a recent penetration test summary and continuity test results; the Tier 1 contract clauses; reassessment at least every 12 months; continuous monitoring. Tier 1 is not a verdict on the supplier. It means the stakes are high, so the assurance must be deep.

• Then: Record the tier, each answer's tier and the reasons

Outcome

Tier 2 Important: a certificate or report, or policies that work

In the pack's defaults: a questionnaire of about 35 questions; a certification or independent report, or key policies with evidence they operate; the Tier 2 contract clauses, with processor terms where personal data is processed; reassessment at least every 24 months; certificate expiry and material changes watched between reviews.

• Then: Record the tier, each answer's tier and the reasons

Outcome

Tier 3 Standard: self-declaration, with some answers checked

In the pack's defaults: a questionnaire of about 15 questions; the supplier's self-declaration, with a sample of its answers, 3 in the pack's default, checked against evidence; a short set of contract clauses; reassessment at least every 36 months; a look at renewal.

• Then: Record the tier, each answer's tier and the reasons

Outcome

Tier 4 Minimal: the intake answers are the assessment

No questionnaire and no evidence request beyond the intake answers, and only the short security clause in the contract. The supplier is still screened and recorded, and screened again at renewal or when the service changes. Tier 4 is a decision that little assurance is needed, not an absence of one. Most suppliers look like this.

• Then: Record the tier, each answer's tier and the reasons

Step

Record the tier, each answer's tier and the reasons

Record the tier in your supplier register with the four placements, any legal floor that applied, a one-line reason for each and the date of screening. An auditor should be able to take the placements, apply the worst-case rule and get the same tier. If more than about 1 in 5 of your suppliers come out Tier 1, the anchors are probably being read too broadly.

• Then: Does the business owner dispute the tier?

Decision

Does the business owner dispute the tier?

Disputes are normal when a lower tier would mean a faster contract. A reason can prompt the assessor to re-read an anchor, but nobody chooses a tier.

• Yes: The head of security settles it; the tier never drops below the rules
• No: Send the tier's questionnaire and evidence request, nothing more

Step

The head of security settles it; the tier never drops below the rules

The Head of Information Security decides a disputed tier. A tier may be raised on judgement. It may never be set below what an answer or a legal floor gives. A request to lower it because assessment is inconvenient is a request for an exception to your supplier policy, and goes through your exception process.

• Then: Send the tier's questionnaire and evidence request, nothing more

Outcome

Send the tier's questionnaire and evidence request, nothing more

Send the set for the tier and never a set above it. A longer questionnaire does not buy more assurance from a supplier that holds nothing of yours; it buys a late answer and a strained relationship. The tier is looked at again at every renewal and whenever the service, data or access changes.