Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

If…, then how…

If a supplier fails assessment but the business has already signed, then what?

5 decision pointsThe pack behind this answer: Third-Party Security Risk Management

Add to board memo

The short answer

Recommendation
Report the early signature, then finish the assessment and let its result choose the decision: approve, approve with conditions, escalate or reject. The signed contract changes what you can make the supplier do, not the risk it leaves you or who decides about it.
Reasoning
No supplier should be engaged before intake screening and a tier, so a contract signed without them is reported to executive management and the supplier is assessed at once (TP-01). The decision follows from the residual risk's position against your appetite and from the open findings; the business owner may choose a stricter decision, never a looser one. A risk outside appetite goes into the risk register and its owner decides the treatment (RM-06). For a supplier already under contract, Reject means running the exit plan.
Considerations
  • The 90 and 180 calendar-day finding deadlines and the 30-day treatment window are the pack's defaults. Your own procedure may set different ones.
  • Outside tolerance, the band's approvers only recommend. Only the board or its equivalent may accept: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board.
  • Rejecting or exiting a Tier 1 supplier is decided at that same level. How fast you can leave depends on the contract's termination and transition terms, so read them before you set a date.
  • Without a remediation clause, a finding is a request in a report. Add a missing clause at the next variation or renewal, or record it as an exception.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartThe contract is signed, and the assessment has found problemsStepReport the signature made before the assessmentStepFinish the assessment: findings, residual risk and positionDecisionWhere does the residual risk sit against appetite?DecisionIs a High finding open?DecisionWill the supplier commit to fixing it by its deadline?StepEnter the supplier risk in your risk registerStepRegister it, and take it to the top approverDecisionWhich treatment does the risk owner choose?DecisionDoes the signed contract carry the clauses for its tier?StepAdd missing clauses at variation or renewal, or record an exceptionOutcomeNot a failure: approve, or add Mediums as conditionsOutcomeApprove with conditions, and track each finding to its deadlineOutcomeAccept the risk formally, for a fixed periodOutcomeReject: plan the exit

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 15 steps.

  1. Start

    The contract is signed, and the assessment has found problems

    This happens when a purchase moves faster than the assessment, or when an existing supplier is assessed for the first time. The contract changes what you can make the supplier do. It does not change the risk the supplier leaves you, or who decides about it.

    In the pack

  2. Step

    Report the signature made before the assessment

    No supplier should be engaged or renewed before intake screening and a tier. When that rule is broken, the Head of Information Security reports it to executive management and the supplier is assessed at once. The pack's policy adds a default: no further orders until the assessment is complete. This is about fixing the purchasing route, not blaming the buyer.

    In the pack

  3. Step

    Finish the assessment: findings, residual risk and position

    Record each gap as a finding with a severity and a deadline from the report date. The pack's defaults are 90 calendar days for High and 180 for Medium. Agree each finding and deadline with the supplier. Then score the residual risk on your risk scale and compare its band with your appetite for third-party risk.

    In the pack

  4. Decision

    Where does the residual risk sit against appetite?

    The position is one of three phrases: within appetite, outside appetite but within tolerance, or outside tolerance. It comes from the band and your appetite for third-party dependency, not from anyone's judgement on the day. The decision follows from it. The business owner may choose a stricter decision, never a looser one.

    In the pack

  5. Decision

    Is a High finding open?

    A High finding is a gap that could directly cause a significant incident or data loss at this supplier. While one is open, the decision cannot be a plain Approve.

    In the pack

  6. Decision

    Will the supplier commit to fixing it by its deadline?

    A supplier that will fix a High finding in time can stay, with the fix as a condition. One that will not is grounds for Reject in the pack's decision table. If the supplier has not given a date in writing, answer no.

    In the pack

  7. Step

    Enter the supplier risk in your risk register

    Outside appetite is not something the business owner signs off alone. The decision is Escalate: the risk goes into the information security risk register and its owner decides treatment. The pack's default is within 30 calendar days of it first being assessed outside appetite. The contract is already signed, so record what the supplier does in the meantime.

    In the pack

  8. Step

    Register it, and take it to the top approver

    Enter the risk in your risk register. Past tolerance, the band's approvers can only recommend; only the board or its equivalent may accept: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. A risk that cannot be brought within tolerance is grounds for Reject.

    In the pack

  9. Decision

    Which treatment does the risk owner choose?

    Reduce means the supplier fixes the gaps, or you add your own controls around it. Accept means keeping the risk knowingly, approved at the right level and reviewed by a date. Avoid means leaving the supplier. Transfer, for example by insurance, usually lowers only the impact, so score what remains and choose again.

    In the pack

    See also

  10. Decision

    Does the signed contract carry the clauses for its tier?

    Check the contract against the clauses for the tier and data type. The remediation clause turns findings into contract deadlines. Without it, a finding is a request in a report. The termination clause lets you leave without penalty when a High finding is not fixed by its deadline. If you have not checked, answer no.

    In the pack

  11. Step

    Add missing clauses at variation or renewal, or record an exception

    The pack's worked example does exactly this for an existing supplier: any missing clause is added at the next variation or renewal, or recorded as an exception. Until then, hold the supplier to the agreed findings in writing and record them as conditions in your register.

    In the pack

    See also

  12. Outcome

    Not a failure: approve, or add Mediums as conditions

    Within appetite and no High finding open, the supplier meets the pack's bar for Approve. The business owner may still make Medium findings conditions, with their deadlines. Record the decision in your supplier register and set the next reassessment date from the tier.

    In the pack

    See also

  13. Outcome

    Approve with conditions, and track each finding to its deadline

    The business owner signs the decision, naming each finding and its deadline. Track them in your register. When a High finding passes its deadline, tell the business owner in writing; the pack's default is within 2 working days. The owner then decides whether to enforce the contract, agree a new date as an exception, or plan exit.

    In the pack

  14. Outcome

    Accept the risk formally, for a fixed period

    Record the acceptance on your risk acceptance form, signed at the level the band and position require, with a review date. Outside appetite but within tolerance, executive management signs as well as the band's approvers. Outside tolerance, those approvers only recommend and the top approver of the previous step accepts. Keep chasing the findings: an acceptance does not stop them being fixed.

    In the pack

    See also

  15. Outcome

    Reject: plan the exit

    For a supplier already under contract, Reject means running the exit plan: move the service, remove its access, and have it return or delete your data. In the pack, rejecting or exiting a Tier 1 supplier is decided by the board, or a board risk committee it has delegated this to; the management board in a two-tier structure; executive management where there is no board. How quickly you can leave depends on the contract's termination and transition terms, so read them before you set a date.

    In the pack

    See also

Practical checklist

  1. Report the contract signed before intake and a tier to executive management. In the pack's default, place no further orders until the assessment is complete.
  2. Record each gap as a finding with a severity and a deadline from the review report date, and agree each with the supplier.
  3. Score the residual risk on your risk scale and compare its band with your appetite for third-party risk.
  4. Choose the decision from the position and the findings. While a High finding is open, it cannot be a plain Approve.
  5. Outside appetite, enter the risk in your risk register so its owner decides the treatment, by default within 30 calendar days.
  6. Check the signed contract against the clauses for its tier and data type, especially remediation and termination for security reasons.
  7. Add any missing clause at the next variation or renewal, or raise an exception for it.
  8. Track each condition to its deadline, and tell the business owner in writing when a High finding passes its deadline.

Evidence to have ready

  • The report of the early signature to executive management, and the date the assessment started.
  • The signed review report: tier, findings with deadlines, residual rating and position, and the business owner's decision.
  • For a risk outside appetite, the risk register entry and the owner's treatment decision, with any acceptance signed at the right level.
  • The contract check against the tier's clauses, with each missing clause's variation or renewal date or exception reference.
  • The supplier register entry, and for a Reject, the exit record with written confirmation that your data was deleted.

Assumptions

  • "Fails" means the assessment found a High finding, or a residual risk outside your appetite for third-party risk. The pack has no pass or fail; it has four decisions.
  • The deadlines and time limits shown are the defaults in the CISO Times third-party and risk management packs. Your own procedure may set different ones.

Not covered here