| Format | Written expert briefing |
| Audience | CISOs, chief risk officers, heads of procurement and vendor management, CIOs, risk committee members |
| Central question | What should executives demand from a third-party cyber-risk program beyond questionnaire completion? |
| Solution | Secure & Comply |
| Service area | Third-Party & Supply-Chain Risk |
Briefing overview
A questionnaire collects assertions. It does not tell an executive which suppliers matter most, what would happen if one failed or was breached, or whether anything changes between annual reviews.
This discussion is for leaders who sign off on third-party risk and want to know what a program should actually produce. It replaces “are the questionnaires done?” with questions that lead to decisions.
What you will take away
-
Six questions to ask your third-party risk owner, and the evidence a good answer includes.
-
A clear distinction between activity measures (completion) and outcome measures (risk reduced).
-
Where decision rights should sit for critical suppliers.
-
A sense of where regulators are heading, using one current example.
Agenda
| Segment | What it covers | What you leave with |
|---|---|---|
| What completion tells you | What a completion rate measures, and what it leaves out | A sharper view of current reporting |
| Two public lessons | Contractor access and provider dependence, from public reporting | Examples to use with your own board |
| Six questions for executives | Prioritization, evidence, failure, concentration, change and outcomes | A question set for your next review |
| Governance and regulation | Who accepts risk, and where supervisors are heading | Clear decision rights |
| Questions | Open discussion | — |
Completion measures activity, not risk
A 100 percent completion rate means suppliers answered. It says nothing about whether any of them are less risky than before, or whether the answers were true. It also treats a payroll processor and a stationery vendor as equals in effort.
Public reporting shows where that gap bites.
-
Contractor access. The joint advisory on Scattered Spider reports that the group buys employee or contractor credentials on illicit marketplaces and compromises third-party services. A supplier’s answer about its own controls says little about how your contractor accounts are protected, or what they can reach.
-
Provider dependence. The Cyber Safety Review Board found the Storm-0558 intrusion into Microsoft’s cloud preventable. In the reporting, the organization that detected it had paid for Microsoft’s highest logging tier and wrote its own detection rules. Many others lacked the logs. No questionnaire answer from the provider would have told those customers what they could not see.
The lesson from both is the same. Third-party risk depends on what the supplier says it does, and also on what you can verify, see and act on.
Six questions for executives
| Ask | What a good program does | Evidence to expect |
|---|---|---|
| Which suppliers could hurt us most? | Tiers suppliers by criticality, data and access, not by spend. Reviews tiers when the business changes | A ranked list with reasoning and a named owner for each critical supplier |
| Is what they told us true? | For critical suppliers, relies on independent assurance, test results or direct validation, not self-attestation alone | A view of which tiers still rest on self-attestation, and why |
| What happens if they fail or are breached? | Writes notification terms, audit rights and exit provisions into contracts, and exercises exit and continuity plans | Contract terms mapped to critical suppliers, and the date of the last exit exercise |
| Who else are they depending on? | Maps key subcontractors and spots many suppliers resting on the same provider | A concentration view |
| What changes between reviews? | Monitors between assessments, with defined triggers and an owner who acts | Examples of triggers raised, actions taken and time taken |
| Is risk going down? | Reports outcomes: critical findings closed, access removed when contracts end, exits exercised | Trends in these measures, with completion rates shown only as a footnote |
Governance: who owns the risk
Security can assess a supplier. It should not be the one to accept the residual risk for a critical one. That decision belongs to the business owner who depends on the supplier, with security and procurement advising. Executives should expect a report that brings exceptions needing a decision, not a dashboard that shows how many assessments are complete.
Where regulation is heading
The Digital Operational Resilience Act (DORA) offers one current example for financial entities in the European Union. It covers ICT third-party risk, including a register of information reported on standard templates and key contractual provisions. It also places critical ICT third-party providers, as designated by the European supervisory authorities, under a dedicated oversight framework.
Whether or not DORA applies to you, our reading is that it shows the direction: know your dependencies, put resilience terms in contracts, and be able to show both. Check the requirements that apply in your own jurisdiction and sector.
Next step
Take the six questions to your next third-party risk review, and ask your program owner to show the evidence column for your five most critical suppliers.
Sources
Scattered Spider (joint cybersecurity advisory) — CISA and partner agencies
CSRB lashes Microsoft’s cascade of security failures — Lawfare. Coverage of the Cyber Safety Review Board review of the Storm-0558 intrusion
Digital Operational Resilience Act (DORA) — European Securities and Markets Authority
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionSecure & ComplyTurn regulatory duties into controls that hold up.See how we work →Related service
Third-Party & Supply-Chain Risk
Use this briefing to strengthen executive decisions around third-party cyber risk.