Supplier Assurance
The practice of assessing and monitoring the cyber security of third parties, so that risk introduced through the supply chain is understood and managed.
- Also known as
- Third-party risk management (TPRM)
- What it addresses
- Cyber risk introduced by suppliers, partners and subcontractors
- Where it is required
- CAF principle A4, government procurement, and data protection law
- Key failure mode
- Assessing every supplier equally instead of proportionately
Supplier assurance is how an organisation gains confidence that the third parties it depends on are managing cyber security adequately. It covers assessing suppliers before contract, monitoring them during the relationship, and acting when their security position changes.
It is also referred to as third-party risk management, or TPRM. The underlying problem is straightforward: an organisation can be compromised through a supplier’s weaknesses as easily as its own, and its internal controls stop at the contract boundary.
Done well, it is proportionate and continuous. Done badly, it becomes an annual questionnaire exercise that consumes effort without materially reducing risk.
What good supplier assurance involves
- SegmentationDecide how much assurance each supplier actually warrants, based on what they access, how critical they are, and what happens if they fail.
- AssessmentUse questionnaires, evidence review and, where the risk justifies it, independent testing — rather than relying on a single questionnaire for every supplier.
- Evidence reviewRead certifications, audit reports and policies for scope and applicability instead of simply collecting and filing them.
- Continuous monitoringRe-check the supplier’s position during the relationship, so a material change is noticed before it becomes an incident.
- RemediationAgree actions with named owners and dates, and track them to closure so findings result in change rather than a record.
Why point-in-time assessment falls short
A questionnaire answered at onboarding describes the supplier on the day they completed it. Staff, systems, subcontractors, certifications and ownership all change, sometimes significantly, well before the next annual review comes round.
Continuous approaches re-check key signals during the relationship — certification status, externally observable posture, breach disclosures and material changes — so that the assurance position reflects the supplier as they are now, not as they were at onboarding.
Where it is required
Supply chain security appears explicitly in the NCSC Cyber Assessment Framework as principle A4, and supply chain expectations run throughout UK government procurement. Departments completing GovAssure need supplier evidence to assess systems their suppliers operate or support.
Data protection law adds separate obligations where a supplier processes personal data, requiring appropriate technical and organisational measures and written terms governing that processing.