Only 11% of UK businesses reviewed the cyber risks posed by immediate suppliers, according to the Cyber Security Breaches Survey 2024. For a small organisation that depends heavily on Microsoft 365 or Azure, a supplier's access can reach email, files or recovery processes. Start a third party risk assessment by identifying what each supplier can access and how that access is protected, then choose checks proportionate to the exposure.
Why Supplier Risk Keeps Slipping Through
Half of UK businesses and 32% of charities reported a cyber breach or attack during the previous twelve months, yet only 11% of businesses reviewed immediate-supplier cyber risks and 6% assessed their wider supply chain, according to the Cyber Security Breaches Survey 2024. For charities, the equivalent supplier-review figures were 9% and 4%.
These figures don't establish how many attacks originated with suppliers. They do expose a gap between organisations' experience of cyber threats and their scrutiny of connected providers.
A third party risk assessment is a documented check of what a supplier can reach, how it protects that access, what happens if it fails and who accepts the remaining risk. It's not just a purchasing form.
The illustration captures the human consequences behind those decisions.
Consider a managed IT provider with Global Administrator rights, a payroll bureau holding staff bank details or a hosted Dynamics 365 integration. Each can expose your organisation through its own accounts, processes or service failures, even without someone breaking directly into your systems.
Start with the actual relationship
For a manufacturing business, supplier information from American Additive Manufacturing can help identify relevant supply relationships, but a directory entry isn't security assurance. You still need to establish access, dependencies and ownership.
Use a working inventory, a tiering method and a repeatable review cycle, supported by practical guidance on risk in the supply chain. Aim initially for an afternoon of quarterly housekeeping, with technical investigations handled separately rather than squeezed into that session.
Tier Suppliers by Risk Before You Score Anything
Supplier tiers, assessment depth and review cycle
| Tier | Typical supplier | Access and data | Assessment depth | Review cycle |
|---|---|---|---|---|
| Tier 1 critical | Managed IT provider, Microsoft 365 or Azure admin partner, payroll bureau | Administrative rights or large volumes of personal data | Full questionnaire, evidence checks and contract review | Annually and after any material change |
| Tier 2 important | Line-of-business SaaS, outsourced HR, hosted CRM | Shared business data without admin rights | Standard questionnaire plus Cyber Essentials or equivalent evidence | Annually or on renewal |
| Tier 3 low | Stationery supplier, catering, a marketing agency with no system access | None, or public data only | Short self-attestation and a standard contract clause | Every two years or on renewal |
Treat these as suggested operating rules, not regulatory deadlines. A hosted CRM containing sensitive case records belongs in the critical tier, regardless of its usual category.
Judge access, not invoice value
Use these placement factors together:
- Privileged access: Can the provider create accounts, change security policies or administer Azure subscriptions?
- Personal-data volume: Does it hold an entire payroll dataset rather than a business contact's details?
- Business criticality: Would losing the service stop invoicing, care delivery or customer support?
- Concentration risk: Does the same provider run your support, backup and identity services?
- Recovery dependence: Can your staff restore operations without the supplier's people or credentials?
The proportionality gap is substantial. Only 11% of microbusinesses and 21% of small businesses reviewed immediate-supplier cyber risks, compared with 32% of medium-sized and 45% of large businesses, according to the Cyber Security Breaches Survey 2025 technical report.
A small team should therefore put its assessment effort into critical suppliers first. Sending every provider the same lengthy form creates work without distinguishing serious exposure from administrative inconvenience.
Apply the distinction
Say your managed IT provider administers Microsoft 365, manages endpoints and controls backup recovery. Place it in Tier 1, even if it's a small local company: its access and recovery responsibilities justify deeper checks.
A stationery supplier receiving only delivery details belongs in Tier 3. Don't demand penetration-test reports unless the relationship changes, such as introducing an integration with your purchasing system.
Charities can use VolunteerBadge's vendor evaluation checklist for nonprofits as a procurement prompt, then tailor the security questions to these access factors.
Practical rule: A certificate demonstrates conformity within a defined scope. Your tier determines how far you must investigate whether that scope protects the service you actually use.
Building a Proportionate Questionnaire by Tier
Ask questions that produce evidence you can review. A confident answer without a named document, configuration record or test result should remain unverified, rather than becoming an automatic pass.
Tier 1 questions that expose operational detail
Build a full questionnaire of roughly twelve to fifteen questions around access, data handling, resilience and exit. Useful examples include:
- Administrator access: Who holds administrator rights to our Microsoft 365 or Azure tenant, and how is multi-factor authentication enforced? Request a role-holder list and relevant policy export.
- Data and subcontractors: Where is our information stored, and which subcontractors process it? Request a data-flow description and current subprocessor list.
- Certification: Do you hold Cyber Essentials, Cyber Essentials Plus or ISO 27001 covering this service? Request the certificate and scope.
- Incident notification: How many hours after discovering a relevant incident will you notify us? Request the contractual commitment and escalation procedure.
- Recovery testing: When did you last test business continuity, and what failed? Request a test summary and outstanding actions.
- Exit: How will you return and delete our data, and how long will that take? Request the exit procedure and deletion confirmation format.
Shorter sets for lower exposure
For Tier 2, use a suggested set of six to eight questions covering security ownership, personnel screening, access restrictions, device protection, updates, incident response and recovery. Ask for Cyber Essentials or equivalent evidence, plus supporting records for any control essential to your service.
For Tier 3, a suggested three- or four-question self-attestation can confirm the service's access boundaries, confidentiality arrangements, incident contact and agreement to report changes. If the answers reveal system access or sensitive information, re-tier the supplier before proceeding.
Keep behavioural expectations in your supplier code of conduct, but don't substitute that document for technical questions. Record what you asked, what the supplier supplied and what you verified.
How to Run the Assessment Step by Step
Only 15% of businesses reviewed immediate-supplier risks and 6% reviewed wider supply-chain risks, according to the Cyber Security Breaches Survey 2025/26. A maintained register and an explicit approval decision are more useful than an ambitious assessment programme nobody can sustain.
The visual groups the work into inventory, controls, risk and actions.
Complete the assessment record
Build the inventory. Record the supplier, service, business owner, data types, administrator or integration access, data location and subcontractors. Include connected applications and contractors, not just providers appearing on the IT budget. Otherwise, departmental purchases remain invisible.
Set minimum requirements. Define the bar for each tier before reviewing responses. For critical providers, include administrator multi-factor authentication, encryption at rest and in transit, and an explicit incident-notification period. Write the agreed notification hours into the contract rather than relying on promptly.
Send the appropriate questionnaire. Cover governance, personnel screening, technical controls, resilience and incident response. Give the supplier a named contact for clarification; unexplained questions invite generic answers copied from another customer's assessment.
Validate the answers. Inspect certificate scope, penetration-test summaries and continuity-test results. Where the supplier manages your tenant, request relevant Microsoft 365 or Azure configuration exports through a secure channel. Redacted evidence or a supervised review can resolve confidentiality concerns without abandoning verification.
Record the risk judgement. Separate inherent risk, before safeguards, from control maturity and residual risk, after safeguards. State why the evidence supports your conclusion. A supplier shouldn't receive a favourable result merely because every field contains text.
Agree contractual actions. Give remediation an owner and deadline. Include incident notification, appropriate audit rights, subcontractor-change notices and practical exit arrangements covering data return, deletion and access removal. Ask whoever owns the contract to confirm that these obligations are incorporated.
Schedule reassessment. Diary annual reviews for critical suppliers and trigger an earlier review after an incident, acquisition or major platform change. Keep one supplier summary linked to dated evidence, findings and the next review date.
Make approval a separate decision
The usual failure is stopping when the questionnaire comes back. The business owner must decide whether to approve, approve with conditions, defer or reject the arrangement.
A returned questionnaire is an input, not a verdict.
Don't demand unrestricted access to a supplier's confidential security material. Agree on enough evidence to support the decision, document any limits, and escalate unresolved uncertainty rather than treating it as low risk.
Use the accompanying video as a discussion prompt when agreeing the process with colleagues.
Scoring Evidence and Mapping It to UK Controls
Evidence types ranked by strength
| Evidence | What it proves | Relative strength | Gap to check |
|---|---|---|---|
| Self-attested questionnaire | The supplier's own statement of its controls | Low | Answers may not match day-to-day practice |
| Cyber Essentials | Basic technical controls assessed through a verified self-assessment | Medium | Scope may exclude the service you buy |
| Cyber Essentials Plus | Basic controls with independent technical testing | Medium to high | Confirm the certificate date and scope |
| ISO 27001 certificate | A management system operating within a defined scope | High | Check service coverage and the statement of applicability |
| SOC 2 Type II report | Controls tested over a period of time | High | Read exceptions and the testing period |
| Penetration test summary | Point-in-time results for named systems | Medium | Check coverage, date and remediation |
These are practical assurance rankings, not interchangeable guarantees. A narrow independent report can tell you less about your exposure than a well-targeted configuration review.
Score the control and its supporting proof
Use a suggested one-to-five scale for each domain, from absent or unverified controls to effective controls supported by current evidence. For critical Microsoft environments, give identity, access and data-location controls greater weight, but treat missing administrator multi-factor authentication as a blocking issue rather than something a good average can conceal.
Map questions to controls and specific artefacts:
- Identity and access: Map to Cyber Essentials user access control. Check privileged role holders, authentication methods and Conditional Access exports.
- Device updates: Map patching to security update management, alongside secure-configuration checks. Request a patch report showing outstanding exceptions.
- Network boundaries: Map to firewalls. Review the relevant configuration summary and approved exceptions.
- Malware protection: Review a Microsoft Defender policy summary alongside deployment coverage, not merely a product licence.
- Data location and subcontractors: Check residency settings, processing arrangements and the current subprocessor list. Cyber Essentials doesn't directly establish these.
A broader Cyber Assessment Framework can help organise assurance without forcing every question into a certification that doesn't cover it.
For suppliers managing OFFICIAL government data, the Government Cyber Security Policy Handbook calls for Cyber Essentials or Cyber Essentials Plus unless equivalent controls are demonstrated. Don't turn that government requirement into a blanket claim about every private-sector supplier.
Check the dependencies behind the certificate
In a 2025 survey of more than 500 UK cyber and risk professionals, 85% reported at least one supply-chain incident in the previous year, only 26.8% reported full visibility across all tiers, and 70% couldn't identify concentration risks involving shared deeper-tier providers, according to Risk Ledger's Every Link Matters survey. This is an industry survey, not a representative measure of all UK businesses.
A supplier might pass its own assessment while relying on the same cloud host or identity provider as your other essential services. Record named fourth parties, the services they support and your alternatives during an outage.
For specialist AI or robotics suppliers, truelabel's guide to tracing the origins of robotics datasets provides a useful provenance lens. Ask where inputs originate and which organisations handle them, rather than stopping at the immediate contracting party.
Strong supplier controls don't remove your need for a workable recovery route.
Challenge vague subcontractor lists, undated test reports and certificates whose scope excludes your service. As an internal review trigger, investigate evidence older than twelve months, but check actual validity and surveillance arrangements rather than assuming age alone invalidates certification.
Remediation Plans and Monitoring Without Losing Track
Remediation timeframes by finding severity
| Severity | Example finding | Required action | Suggested deadline |
|---|---|---|---|
| Critical | Administrator accounts without multi-factor authentication | Restrict access or fix before go-live | 7 to 14 days |
| High | No incident-notification commitment in the contract | Amend the contract or add a side letter | 30 days |
| Medium | Outdated patching on a supplier-managed server | Agree a patch schedule and evidence it | 90 days |
| Low | Missing policy review date | Record the gap and check at next review | Next scheduled review |
These are suggested planning windows, not regulatory requirements. Adjust them to exploitability, business impact and your risk appetite, and record the reason. A critical finding needs immediate containment; its planning window isn't permission to leave unsafe administrator access active.
Give every finding an owner
Track supplier name, tier, business owner, inherent risk, residual risk, evidence expiry date, remediation deadline and escalation status. Keep individual findings linked to the supplier rather than compressing several unresolved problems into a single green status.
Measure outcomes, not returned forms. Useful measures include:
- Onboarding coverage: Percentage of critical suppliers assessed before access is granted.
- Evidence currency: Percentage with current supporting evidence.
- Remediation performance: Percentage of high-risk findings closed by deadline.
- Outstanding exposure: Mean age of open remediation items.
- Recovery assurance: Percentage tested through an incident or continuity exercise.
This emphasis on coverage, evidence and remediation is consistent with the practical assurance approach discussed in Risk Ledger's comparison of attack-surface management and third-party risk management.
Escalate missed commitments
Start with a written reminder naming the overdue finding, business consequence and revised deadline. If the supplier misses that commitment, involve the contract owner and review the available contractual remedies.
Then make a recorded decision: restrict access, introduce compensating controls, accept the risk temporarily with senior approval or prepare to change supplier. Don't threaten termination if you haven't established how the business would operate during the transition.
For regulated financial firms, the FCA's outsourcing and operational-resilience guidance makes clear that accountability remains with the regulated organisation throughout the arrangement's life cycle. For other organisations, the same management discipline is sensible: assign someone internally who can make the decision, rather than leaving an overdue action with the supplier indefinitely.
Start With Your Top Ten Suppliers This Quarter
A bounded first pass is better than an unfinished review of every supplier. Start with the relationships capable of causing the greatest disruption.
- List the exposed services. Identify providers with administrative access, bulk personal data or dependencies on your Microsoft 365 or Azure tenant. If the list is longer, begin with your top ten.
- Assign a tier. Use access, data sensitivity, operational importance and recovery dependence.
- Request critical evidence first. Start with Tier 1 suppliers and record certificate expiry dates and unresolved gaps.
- Book the follow-up. Put review dates and remediation deadlines into a shared calendar with named owners.
You can run this in a controlled spreadsheet, use a supplier-risk platform or bring in a Microsoft-focused IT partner. Choose the option your team can maintain, not the one with the longest feature list.
F1Group provides Microsoft-focused managed IT support across Lincoln, Nottingham, Leicester, Scunthorpe, Grimsby and Newark, and can help review Microsoft 365 and Azure configuration evidence, assess critical suppliers and establish an owned remediation register. Phone 0845 855 0000 today, or Send us a message to arrange a practical first pass through your supplier risks.