Not every supplier needs the same assessment. Tier vendors by data access, connectivity, business criticality and replacement difficulty.
Request evidence that matches the risk and use contract clauses to make responsibilities, notification and assurance rights clear.
Key points
- ✓ Tier suppliers by exposure
- ✓ Request relevant evidence
- ✓ Define incident notification
- ✓ Plan secure exit