Scope the service and dependence
Begin with what the supplier provides, which information it handles, how it connects, what authority it receives and how operational failure affects the organisation. A questionnaire without this context produces generic answers that are difficult to evaluate.
Record internal owner, contract term, locations, subcontractors, exit constraints and alternative processes. Distinguish a low-impact commodity from a provider embedded in identity, payments, production or recovery. The depth of review should follow consequence and replaceability.
Ask for evidence that matches the risk
Review identity and access, secure development, vulnerability handling, logging, incident communication, continuity and data lifecycle where relevant. Independent reports and certifications can inform confidence, but their scope, date, exclusions and tested services must match the service being purchased.
Clarify how the supplier notifies customers, supports investigation, removes access and returns or deletes information. For technical integrations, inspect permissions, tokens, network paths and administrative roles. Track unresolved gaps as decisions rather than hiding them in procurement attachments.
Monitor change and prepare exit
Reassess after major service changes, acquisitions, incidents or material subcontractor changes. Monitor public advisories, service status and internal indicators such as unused access or failed exports. Keep verified contacts outside the supplier platform.
Test data export, credential revocation and transition for critical services. An exit plan should cover information, identity, integrations, configuration and retained records. Report concentrated supplier dependence to leadership so resilience choices can be funded before a crisis.
What to do next.
- ✓Describe service, data, access and business dependence.
- ✓Scale review depth to consequence and replaceability.
- ✓Check assurance scope, date and exclusions.
- ✓Inspect technical permissions and integration paths.
- ✓Reassess after material supplier change.
- ✓Test export, revocation and exit for critical services.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.
Reuben Botha
Enterprise Security ContributorFocuses on security programmes, risk translation and practical roadmaps that connect technical findings to accountable action.
More from this writer