You may be a business that, as a data controller, must carry out security due diligence assessments of any data processor. Alternatively, you may be a business whose customers or insurers contractually require you to carry out third-party security assessments of all your suppliers. In either case, deciding how to carry out a security assessment that is effective, not too demanding on your business or supplier, and offers value for money is a challenge.

There are online third-party supplier risk assessment tools, but they often have a large question set and require tailoring to meet your needs. These solutions can be expensive, and it can be daunting to decide what questions appropriately assess a supplier's risk to your business.

We can thoroughly assess your current procurement and supply chain processes, identify gaps, and compare them to best practices. We'll provide you with an actionable report that outlines recommendations to improve the security of your supply chain and procurement processes.

We can produce pragmatic security questionnaires to ensure that you understand your suppliers and the risks they pose to the business. We can also support you in evaluating responses and advise you on the risk.

Businesses, Governments, and local authorities now require the completion of their security questionnaires as part of their procurement process, and in some cases, these questions can number in the hundreds. Also, their "one-size fits all" approach results in a small supplier of business services having to complete the same questionnaire as an outsourced HR or IT provider.

For small businesses, these questionnaires can be daunting, time-consuming and even a barrier to entry for new business opportunities. We can assist in providing details of why questions are not relevant or appropriate and explain what security controls are in place and how they manage the risk. Where required, we can produce appropriate supporting collateral such as a security policy, risk assessment or other documentation.