All the boxes are checked. The supplier confirms encryption, access controls, regular backups, and an emergency response plan. The questionnaire goes into the file, and the supplier evaluation is considered complete. But would you really base your critical business processes solely on these answers?
A questionnaire reveals what a supplier says about its security. However, it does not show how well the described measures work in practice. This article explains what a risk-based supplier assessment looks like, what requirements ISO 27001 and NIS-2 place on supplier management, and how companies can achieve reliable results with reasonable effort.
Why Suppliers Become a Security Risk
Hardly any company operates today without external partners. Cloud providers store data, IT service providers operate systems, software vendors have remote maintenance access, and logistics partners have access to customer addresses. Each of these partners expands a company’s attack surface. Numerous security incidents in recent years did not originate within the affected company itself, but rather with a service provider or within the software supply chain. For information security, this means that a company’s own protective measures are only as strong as those of the partners who have access to its data, systems, or processes.
What a Questionnaire Can and Cannot Do
Self-reports are a useful starting point for supplier evaluation. They provide an initial overview, make your own expectations transparent, and establish a documented basis for further discussions. However, their limitations stem from their very nature: they reflect only the supplier’s perspective. Whether the stated multi-factor authentication actually applies to all administrator accounts or whether the emergency response plan has ever been tested cannot be determined from a simple checkmark.
There is also a practical problem. Many questionnaires are generic and are sent to all suppliers alike, whether they are cafeteria operators or data center service providers. This takes up time on both sides without adequately highlighting the truly critical relationships.
What Requirements Are Set by ISO 27001 and NIS-2?
ISO 27001 devotes several controls to supplier relationships in Annex A. A.5.19 requires processes to manage information security risks arising from the use of supplier products and services. A.5.20 requires that security requirements be agreed upon contractually; A.5.21 addresses the ICT supply chain; and A.5.22 addresses the regular monitoring and review of supplier services. The last point in particular makes it clear that a one-time assessment is not sufficient.
The European NIS 2 Directive also explicitly lists supply chain security in Article 21 as one of the risk management measures that affected entities must implement. In doing so, they must also take into account the security practices of their direct suppliers and service providers. In the automotive industry, TISAX has also meant that supplier evaluation and documentation have long been part of day-to-day operations.
Risk-Based Supplier Evaluation in Four Steps
Determine criticality
The starting point isn’t the questionnaire, but the question: What does our business depend on? Three criteria help with the assessment. Does the supplier have access to sensitive or personal data? Does it support a critical business process? And how difficult would it be to replace it on short notice? Those who have already conducted a business impact analysis will find many answers here. The classification determines how in-depth the supplier evaluation needs to be in each individual case.
Request the appropriate documentation
For critical suppliers, self-declarations are not sufficient. Acceptable forms of evidence include an ISO 27001 certificate, a TISAX label, audit reports in accordance with SOC 2 or ISAE 3402, summaries of penetration tests, or records of emergency drills. When it comes to certificates, it’s worth taking a close look at the scope: Does it truly cover the service you’re purchasing? In particularly critical cases, an audit of the supplier may also be appropriate.
Track Gaps and Agree on Actions
Discrepancies are not a reason to immediately terminate a partnership. What matters is how they are handled. If gaps are identified, specific measures—including deadlines and designated responsible parties—should be agreed upon and, ideally, set forth in a contract. If risks remain, they must be carefully assessed and formally accepted in writing.
Monitor continuously
A supplier assessment is a snapshot. Services change, new subcontractors are added, data center locations are relocated, and a company’s own dependencies also grow. The frequency of reviews should therefore be based on criticality and also be triggered by specific events, such as a security incident at the supplier or a significant contract change.
Supplier Evaluation in Practice: A Typical Scenario
A medium-sized automotive supplier has its data backup managed by an external IT service provider. The questionnaire returns with entirely positive results, and an ISO 27001 certificate is on file. Only upon closer inspection does it become clear that the scope of the certificate covers only the hosting, not the managed backup service. A data recovery test for this customer’s data has never been performed. Both parties agree to conduct an annual recovery test with a results report. Without a risk-based supplier assessment, this gap would not have been noticed until a crisis occurred.
At Syngenity, we help companies align their supplier evaluations with criticality, evidence, and ongoing risk—from supplier classification to continuous monitoring.
Conclusion: Supplier evaluation requires more than just checking boxes
A questionnaire is a useful starting point, but it is not proof. An effective supplier assessment begins with your own risk, requires robust evidence from critical partners, consistently tracks down gaps, and is repeated regularly. In this way, companies not only meet the requirements of ISO 27001 and NIS-2, but—above all—protect their critical processes. Ultimately, it’s not the answers on the questionnaire that matter, but the decisions you make based on them.
How does your company verify the security of its suppliers after the questionnaire has been returned?
