Best Practices

How to Assess Cyber Risks at Suppliers

Structured cyber risk assessment at suppliers is mandatory under NIS2, DORA and ISO 27001 — and with the right tools achievable in hours rather than weeks.

Assessing cyber risks at suppliers combines external security assessments (360TPRM), questionnaires and due diligence reviews into a complete risk picture.

Steps 1-3: External assessment and data collection

Step 1 — External cyber intelligence assessment (360TPRM): attack surface scan, dark web monitoring, CVE check, SSL/TLS analysis, email security check. Result: an objective risk score without supplier involvement, in under 24 hours. Step 2 — Certificate check: is an ISO 27001 certificate present and current? Is a SOC 2 Type II report available? TISAX (automotive) or PCI DSS (payments) if relevant? Step 3 — Questionnaires (selective): for critical suppliers, a targeted set of questions on specific security controls. Not for every supplier — that doesn't scale.

90% external — 10% internal

Best practice: 90% of risk assessment is based on external data (360TPRM, certificates). Questionnaires only for critical suppliers and targeted deep-dive checks.

Steps 4-6: Assessment, documentation and follow-up

Step 4 — Overall assessment: external score + certificate status + internal judgement (criticality, dependency) = overall risk level. Step 5 — Documentation: record the assessment result, log the date and methodology, file it in an audit-ready format. Step 6 — Follow-up: if risk is high, notify the supplier, request a remediation plan, consider an exit option. Regular re-assessment: continuous for critical suppliers (360TPRM), annual for others.

Questionnaires alone aren't enough

Questionnaires measure self-disclosure — not the actual security situation. 360TPRM measures what's really visible externally. Combining both approaches is best practice.

FAQ

How long does a cyber risk assessment take?+

With 360TPRM: an initial external assessment in under 24 hours. Full due diligence including a questionnaire: 1-2 weeks for critical suppliers.

Does every supplier need the same level of scrutiny?+

No — a risk-based approach: full assessment for critical suppliers, a simplified external check (360TPRM score + certificate status) for standard suppliers.

Assess supplier cyber risks efficiently

See in a 45-minute demo how 360TPRM specifically meets your requirements.

Request free demo →