Correct supplier classification is the foundation of efficient TPRM — it determines monitoring intensity, due diligence depth and regulatory documentation obligations.
Steps 1-3: Classification criteria and model
Step 1 — Define classification criteria: data access (sensitive/personal data?), system access (access to critical IT systems?), process dependency (how critical is the process being supported?), substitutability (how easily can the supplier be replaced?), regulatory relevance (classified as critical under DORA or NIS2?). Step 2 — Define a tier model: 3 tiers work well in practice (critical/important/standard). Step 3 — Build a scoring matrix: assign a weight to each criterion, set threshold values for each tier.
More than 3 classification tiers add operational complexity without added value. Critical/important/standard covers 95% of all TPRM requirements.
Steps 4-6: Execution and maintenance
Step 4 — Classify every supplier: structured interviews with the relevant business units, incorporating external data points (360TPRM risk score), documenting and justifying the classification decision. Step 5 — Management approval: have the classification list approved by the CISO and executive management. Step 6 — Regular review: at least annually and whenever the supplier relationship changes materially; 360TPRM automatically triggers reviews when risk changes.
If 60% of all suppliers are classified as critical, the classification loses its steering effect. Best practice: classify no more than 20-30% as critical.
FAQ
Classify suppliers systematically
See in a 45-minute demo how 360TPRM specifically meets your requirements.
Request free demo →