Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

When do we reassess a supplier we already use?

4 decision pointsThe pack behind this answer: Third-Party Security Risk Management

Add to board memo

The short answer

Recommendation
Reassess on the schedule the tier sets, and sooner whenever something changes. Start a scheduled reassessment before it falls due, start a triggered one promptly after an incident, breach or material change, and run a fresh intake for any renewal or new service, data or access.
Reasoning
An assessment describes the supplier and your use of it on the day it was done. Services, data and access drift during a contract, and suppliers have incidents or change hands. A triggered reassessment starts from the tiering step because the tier may change. A renewal, or a new service, data or access, means a fresh intake, because a new integration or a new batch of customer data is often enough to move a supplier up a tier. Tier 4 suppliers have no scheduled review, so screening again at renewal is what catches the day they start to hold your data.
Considerations
  • The intervals (at least every 12, 24 and 36 months for Tiers 1 to 3), the 60-day lead time, the 10 working days for a triggered start and the 3 months to assess at a new tier are the pack's defaults. Your own model may set different ones.
  • An overdue reassessment goes to the business owner and is named in the quarterly report to executive management. The pack's target is no Tier 1 overdue, and none more than 90 days overdue.
  • An incident at the supplier is also handled under your incident response plan.
  • A change in your own list of critical services or your regulatory status also means a fresh intake.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartA supplier you already useDecisionHas anything changed?StepStart a triggered reassessment from the tiering stepStepRun a fresh intake and tier it againDecisionDid the tier change?OutcomeAssess it at the new tier within 3 monthsOutcomeKeep the current evidence until the next scheduled reviewOutcomeRun the assessment for the same tierDecisionIs it a Tier 4 supplier?OutcomeNo scheduled review; screen it again at renewal or on changeDecisionWhere is it against its tier's interval?OutcomeStart the scheduled reassessment nowOutcomeOverdue: tell the business owner and start it nowStepKeep watching as the tier requires

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 14 steps.

  1. Start

    A supplier you already use

    An assessment describes the supplier and your use of it on the day it was done. Services, data and access drift during a contract, and suppliers change hands or have incidents. Reassessment keeps the tier and the evidence true.

    In the pack

  2. Decision

    Has anything changed?

    Changes reach you through monitoring, the contract's notice clauses, the business owner and Procurement. A supplier that must give notice of material changes, such as a change of control, a lost certification or a new subcontractor, makes this question easier to answer.

    In the pack

  3. Step

    Start a triggered reassessment from the tiering step

    An incident, a breach, a change of ownership or of the supplier's key subcontractors, or any other material change. In the pack's default, start within 10 working days of learning of it, from the tiering step, because the tier may change. An incident is also handled under your incident response plan.

    In the pack

    See also

  4. Step

    Run a fresh intake and tier it again

    A renewal or extension, a new service, new data or new access, or a supported service becoming critical, is a new intake, not a note on the file. So is a change in your own list of critical services or your regulatory status. For a renewal, do it before the renewal is signed.

    In the pack

    See also

  5. Decision

    Did the tier change?

    Apply the usual rule: the tier is the highest any criterion reaches, never below a legal floor. A new integration or a new batch of customer data is often enough to move a supplier up.

    In the pack

  6. Outcome

    Assess it at the new tier within 3 months

    In the pack's default, a supplier that moves up is assessed at its new tier within 3 months: the new questionnaire set, the new evidence, and the contract checked against the clauses for the new tier. In the pack's worked example, a missing clause is added at the next variation or renewal, or recorded as an exception.

    In the pack

    See also

  7. Outcome

    Keep the current evidence until the next scheduled review

    A supplier that moves down keeps its current evidence until its next scheduled reassessment, which then follows the lower tier's interval and set.

    In the pack

  8. Outcome

    Run the assessment for the same tier

    After an incident, breach or other material change, the reassessment goes ahead at the same tier: questionnaire, evidence, findings, residual risk and a signed decision. For a renewal, the procedure runs the assessment for the tier before signature.

    In the pack

    See also

  9. Decision

    Is it a Tier 4 supplier?

    Tier 4 suppliers have no data, no access and no service dependency, so they have no scheduled reassessment.

    In the pack

  10. Outcome

    No scheduled review; screen it again at renewal or on change

    Its intake answers are its assessment. Screening again at renewal is what catches the day it starts to hold your data or connect to your systems.

    In the pack

  11. Decision

    Where is it against its tier's interval?

    In the pack's defaults, Tier 1 is reassessed at least every 12 months, Tier 2 every 24 and Tier 3 every 36, counted from the last assessment date. The pack starts a reassessment 60 calendar days before it is due, so the answers arrive in time.

    In the pack

  12. Outcome

    Start the scheduled reassessment now

    Start at the questionnaire stage with the same tier, unless the intake answers have changed. Send the tier's set and evidence request, and write a new review report with a signed decision.

    In the pack

    See also

  13. Outcome

    Overdue: tell the business owner and start it now

    An overdue reassessment goes to the business owner and is named in the quarterly report to executive management. The pack's target is no Tier 1 reassessment overdue at all, and none more than 90 days overdue.

    In the pack

  14. Step

    Keep watching as the tier requires

    In the pack's defaults, Tier 1 is watched continuously for breach news, certificate and report expiry, and material changes. Tier 2 is watched for certificate expiry and material changes. Tier 3 is checked at renewal. The pack's contract clauses make the supplier tell you when a certificate is suspended, withdrawn or reduced in scope, and treat losing a certification as a material change.

    In the pack

Practical checklist

  1. Keep each supplier's tier, last assessment date and next due date in your supplier register.
  2. Watch Tier 1 continuously for breach news, certificate and report expiry and material changes, and Tier 2 for certificate expiry and material changes.
  3. Start a triggered reassessment from the tiering step within 10 working days of learning of an incident, breach or material change.
  4. Run a fresh intake for a renewal, a new service, data or access, or a change in your own critical services or regulatory status. For a renewal, do it before signature.
  5. If the tier moves up, assess at the new tier within 3 months and check the contract against its clauses.
  6. Start each scheduled reassessment 60 days before it is due, at the questionnaire stage with the same tier.
  7. Tell the business owner of any overdue reassessment, and start it now.

Evidence to have ready

  • The register showing each supplier's tier, last assessment date and next due date (TP-09).
  • A reassessment record after each material change, incident or breach at a supplier (TP-09).
  • The intake and tier for each renewal, dated before the renewal was signed (TP-01).
  • A new review report with a signed decision for each reassessment.
  • The quarterly report naming any overdue reassessments.

Assumptions

  • Every supplier you use has a tier and a last assessment date in your supplier register.
  • The intervals and lead times shown are the defaults in the CISO Times third-party pack. Your own model may set different ones.

Not covered here