Supplier security management
Suppliers often touch your data. We structure assessment, contract clauses and follow-up so third-party risk is visible and managed.
What we see too often
Your clients ask for ISO 27001 while your data lives with three cloud providers, an MSP and a freelancer with no clause. Annex A planned for this: suppliers are a target, and a hole in the ISMS.
- no inventory of suppliers that touch information
- contracts with no security clause, or clauses nobody read
- a client questionnaire nobody can answer for the supply chain
- the same bar for the critical host and the pen supplier
- no follow-up after signature: you “trust them”
What this module is
Supplier management means knowing who processes your information, at what risk level, with which requirements, and how you check it. It is not boycotting the cloud, nor auditing every subcontractor like a certification body.
We set an inventory, a simple classification, model clauses and a proportionate review rhythm. The critical supplier often enters scope through this module, even if they are not “on your premises”.
Where this sits in ISO 27001
The module covers Annex A supplier controls and the link to scope (clause 4). ISO 27017 helps for cloud; it is not a twelfth module.
What this module includes
- Inventory of suppliers critical to the ISMS
- Proportionate assessment criteria and questionnaires
- Security clauses for contracts
- Periodic follow-up and offboarding conditions
How we work
Inventory and criticality
Who has access to what. We drop the noise and keep those who weigh on confidentiality, integrity or availability.
Requirements and clauses
What you must require, what is already in the contract, what is missing. Text your lawyer or leadership can use.
Entry assessment
A questionnaire or proportionate review before opening access. Not 200 questions for a harmless internal tool.
Follow-up and exit
Review rhythm, incidents at the supplier, access revocation. A forgotten supplier remains an open access.
What you receive
- Critical supplier inventory
- Questionnaire and scoring grid
- Security clause templates, adapted for Quebec
- Follow-up register and review calendar
Who it is for
SMBs that rely on cloud, MSPs, contractors or integrators, and that must answer client questionnaires.
Who it is not for
This module is not a certification audit of your suppliers, nor a replacement for the SoA. It also does not rewrite all your commercial contracts.
Typical duration
2 to 5 weeks depending on the number of critical suppliers.
What you need to provide
You provide the list of tools and subcontractors, template contracts, and someone who knows who actually has access to client data.
What this module does not cover
This module frames third parties. It does not replace an audit of every supplier or full legal negotiation.
Frequently asked questions
- Must every supplier be assessed?
- No. We prioritize those that touch information in scope. Others stay in a lighter inventory.
- Is a supplier SOC 2 report enough?
- It is a useful input, not a conclusion. You still need to judge what applies to your use and what is missing.
- What about AI or SaaS tools adopted by teams?
- If they process your information, they belong in the inventory. ISMS governance then decides who may authorize them.
- Can we buy only this module?
- Yes. Each module is sold separately. You do not have to buy the full programme. The pre-assessment remains the most efficient entry point if you do not yet know where to start.
- Do we have to start with the pre-assessment?
- No, it is not mandatory. The pre-assessment speeds up scoping if you do not yet have a full picture. If you already know what is missing, we can start this module directly.