How to measure supplier risk: a practical 5‑step method
Even the strongest defence can fall through the weakest supplier. How to make supplier risk measurable instead of just documented.
Published: · 2 min read · HilfeX Security Team
- Start with an inventory of every supplier, then tier them by criticality.
- Match assessment depth to criticality; not every supplier gets the same long questionnaire.
- Update the risk score at least yearly and after incidents.
Cloud software, maintenance firms, development partners and logistics providers access your systems and data. Many high‑impact attacks in recent years reached their target through a supplier rather than directly. ISO 27001 requires information security in supplier relationships, and NIS2 explicitly lists supply‑chain security among its risk‑management measures.
1. Inventory: who accesses what?
Put every supplier on one list: the service, the systems they can reach, the data they process (especially personal data) and whether they have remote access. Procurement and IT often keep separate lists; merge them.
2. Tier by criticality
Rate each supplier, for example high, medium or low. Criteria: impact on operations, depth of access, sensitivity of data and replaceability. Maintenance firms with remote access to OT systems are usually high.
3. Assess: questionnaire and evidence
- High: a full questionnaire, evidence (certificates, policy samples, pentest summary) and a call if needed.
- Medium: a short questionnaire and basic evidence.
- Low: a basic declaration.
Basing questions on recognised frameworks such as ISO 27001 Annex A and NIS2 makes answers comparable.
4. Risk score and contract
Score answers by control area and combine them with criticality into a risk score. Ask for a remediation plan on high‑risk findings. Add information security, incident notification, audit rights and sub‑processor rules to contracts.
5. Monitor continuously
Repeat the assessment at least yearly and after significant changes or incidents at the supplier. At contract end, confirm all access is closed.
The supplier risk score module in HilfeX IQ Portal automates sending, reminders, evidence collection and reporting in one dashboard.
Frequently asked questions
Should every supplier get the same questionnaire?
No. Assessment depth should match criticality, otherwise both sides carry unnecessary load.
Do ISO 27001‑certified suppliers still need assessing?
The certificate is a strong signal, but check that its scope covers your service and that it’s valid.
How often should assessments be renewed?
Usually at least yearly and after significant changes or incidents.
