A questionnaire records what a supplier says about itself at one moment. Material exposure usually sits elsewhere: in the access you gave them, the data they hold, the code they ship into your environment, and what happens to your business when they fail.
The scale is not trivial. Verizon’s Data Breach Investigations Report found that third-party involvement in breaches had doubled to 30% in its latest edition at time of review. Definitions of “third party” vary between reports, so read the figure as direction, not precision.
Why questionnaires miss
-
They are self-attested. The answers reflect what the supplier believes or wants you to believe, and they age quickly.
-
They scope the company, not the connection. Your risk comes from the specific service, integration and account you use, not the supplier’s entire estate.
-
They treat every supplier alike. Effort goes into volume. A stationery vendor and a payroll processor get the same form.
-
They ignore your side. They do not ask what access, data or dependency you have granted.
-
They cannot see fourth parties or concentration. If several of your suppliers rely on one hosting or software provider, no single questionnaire shows it.
-
They stop at the answer. They do not test whether the supplier will notify you in time, or whether you can operate without them.
Four incidents, four different exposures
Public incidents show how different third-party exposure can be. These are documented events. Each exposed something a questionnaire would not have surfaced.
| Incident | What happened | Exposure it illustrates |
|---|---|---|
| SolarWinds Orion | Attackers inserted malicious code into legitimate software updates distributed to customers. | Trust in a vendor’s software update channel. |
| Kaseya VSA | Attackers abused a remote management product to push ransomware to customers of managed service providers. | Privileged remote tooling and the providers behind it. |
| MOVEit Transfer | A vulnerability in a file-transfer product was exploited at scale to steal data from organizations using it. | Sensitive data held in a supplier’s product. |
| Faulty security-vendor update | A defective content update from a security vendor crashed large numbers of Windows systems. It was not an attack. | Availability and concentration risk in a single provider. |
Tier by exposure, not by spend
Contract value is a poor guide to risk. Tier suppliers by what they could do to you.
| Factor | Question to ask |
|---|---|
| Data | What data do they hold or process, and how sensitive is it? |
| Access | What network, identity or privileged access do they have? Is it standing or on request? |
| Code and updates | Do they supply software or updates that run inside your environment? |
| Operational dependence | If they were unavailable, what stops, and how long before it matters? |
| Substitutability | How hard would it be to replace them, and what is the exit plan? |
| Concentration | Do other critical suppliers depend on the same provider? |
| Regulatory weight | Does your regulator treat this as outsourcing or a critical dependency? |
The result is a short list of critical suppliers, a larger middle tier, and a long tail. Assessment depth should follow the tier.
| Tier | Assessment approach |
|---|---|
| Critical | Evidence-based review: independent assurance reports checked for scope and exceptions, architecture and access review, tested incident notification, fourth-party mapping, exit plan, and ongoing monitoring. |
| Significant | Shortened questionnaire focused on the service in use, assurance report review, and contract security terms. |
| Standard | Contract baseline and business-owner attestation. |
Better questions
| Instead of asking | Ask |
|---|---|
| Do you have an incident response plan? | When did you last test it? Will you notify us within a stated time of suspected compromise affecting our data or access? |
| Do you encrypt data? | Where is our data stored, who controls the keys, and how is it deleted when we leave? |
| Do you have a SOC 2 report? | Does the report cover the service we use and the period we rely on? Do any exceptions touch our data? |
| Do you use MFA? | Which methods protect your administrative access to our environment, and who can approve changes there? |
Reduce exposure on your side
Assessment finds problems. Your own architecture limits them. For critical suppliers, grant the least access needed, require strong authentication on every supplier account, monitor and time-limit privileged sessions, share only the data required, and segment supplier connections from core systems. Write notification duties, assessment rights and exit support into the contract, and test the exit plan.
A questionnaire cannot reduce access you have already given. Only you can.
What the frameworks expect
The NIST Cybersecurity Framework 2.0 includes a supply chain risk management category under Govern. It expects organizations to identify their technology suppliers and rank them by criticality, and to include suppliers in incident planning, response and recovery. In the EU, supply chain security is one of the measures the NIS2 Directive lists for essential and important entities, and the Digital Operational Resilience Act sets ICT third-party requirements for financial entities, including a register of contractual arrangements. Applicability depends on sector and jurisdiction. Check your own regulator’s outsourcing rules as well.
Where to start
-
Build a supplier inventory with the business owner, the service, the data and the access for each entry.
-
Score each against the factors above and name the critical tier.
-
Review the critical tier in depth. Accept that the rest will receive less.
-
Replace the generic questionnaire with tier-specific requests.
-
Test one thing you have never tested, such as supplier notification or an exit.
Limits
Deep review needs supplier cooperation, and leverage varies. With large dominant providers you may receive only standard assurance reports. Where you cannot inspect, manage the risk through resilience: backups you control, segmentation, alternative providers and a rehearsed exit.
Sources
-
Verizon. Data Breach Investigations Report, third-party involvement findings. verizon.com
-
National Institute of Standards and Technology. The NIST Cybersecurity Framework 2.0, Special Publication 1305, Govern function, Cybersecurity Supply Chain Risk Management category (GV.SC). https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.1305.pdf
-
European Union. NIS2 Directive, Article 21, cybersecurity risk-management measures. eur-lex.europa.eu
-
European Union. Digital Operational Resilience Act (DORA), ICT third-party risk management provisions. eur-lex.europa.eu
-
Cybersecurity and Infrastructure Security Agency. Emergency directive and guidance on the SolarWinds Orion compromise. cisa.gov
-
Cybersecurity and Infrastructure Security Agency and FBI. Guidance on the Kaseya VSA ransomware incident. us-cert.cisa.gov
-
Cybersecurity and Infrastructure Security Agency and FBI. Advisory on exploitation of MOVEit Transfer. cisa.gov
-
CrowdStrike. Root cause analysis of the Falcon content update incident. crowdstrike.com
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionSecure & ComplyTurn regulatory duties into controls that hold up.See how we work →Related service
Third-Party & Supply-Chain Risk
Use this to prioritize supplier and dependency risk.