How to Conduct a Supplier Risk Assessment Under NIS2

Supplier risk assessments usually become urgent after somebody asks a simple question: “Which of our suppliers would create the biggest problem if they were compromised tomorrow?”

At that point, many organizations discover they have a vendor list but not a supplier risk assessment process.

Cloud providers, software vendors, MSPs, payroll platforms, outsourced support teams, and data processors — most organizations depend on dozens of third parties every day. Yet suppliers are often reviewed inconsistently. That approach becomes harder to defend under NIS2. Article 21 requires organizations to consider cybersecurity risks introduced by suppliers and service providers. The challenge is not collecting vendor information — it is identifying which suppliers matter most, assessing them consistently, and documenting decisions in a way that stands up to audits.

In this guide, you’ll learn:

• What a supplier risk assessment is
• How a practical supplier risk assessment process works
• Which supplier risk assessment criteria should be reviewed
• How to prioritize suppliers based on risk
• A supplier risk assessment example
• Common mistakes that weaken supplier reviews

What is a supplier risk assessment?

A supplier risk assessment is a structured way to evaluate the cybersecurity risk introduced by a vendor, service provider, or other third party. The goal is not to decide whether a supplier is secure — it is to understand how much risk the supplier creates for your organization. A cloud provider hosting customer data and a company delivering office supplies are both suppliers, but they do not create the same level of cybersecurity risk. A supplier risk assessment helps answer questions such as: does the supplier have access to sensitive information? Does it support critical business services? Could a supplier incident disrupt operations? Does the supplier maintain appropriate security controls?

Why supplier risk has become a bigger cybersecurity problem

A supplier risk assessment is no longer just a procurement exercise. If one supplier experiences a security incident, the impact can quickly extend beyond their environment. That is one reason supply chain security became a specific focus under NIS2.

For additional context, see the official text of Article 21 in the NIS2 Directive, which outlines cybersecurity risk management requirements, including supply chain security measures.

How to conduct a supplier risk assessment

Most effective supplier risk assessment frameworks follow a similar approach. Organizations first identify suppliers that introduce cybersecurity risk, collect relevant security information, evaluate supplier risk against defined criteria, assign a risk level, and document the decision for future reviews. The process should be consistent enough to compare vendors fairly while remaining practical to maintain as the supplier ecosystem grows.

Supplier risk assessment criteria

Imagine two suppliers. One provides office coffee machines. The other hosts your customer portal. Both completed the questionnaire, both have a security policy — yet nobody would treat them as the same level of risk. That is why supplier assessments cannot stop at collecting answers. When reviewing suppliers, we usually focus on six questions:

• Could the supplier disrupt critical operations? Revenue-generating services and customer-facing systems deserve more attention than a non-critical function.
• What can the supplier access? A vendor with administrative access to cloud infrastructure creates a very different risk profile than one with no technical access.
• What data is involved? Customer data, employee records, financial information, and intellectual property all increase potential impact.
• Can the supplier demonstrate security practices? Not promises — evidence: policies, certifications, test results, audit reports.
• What happens if they have a security incident? Some suppliers recover quickly; others struggle to detect, notify, or restore services.
• Could you operate without them? The harder a supplier is to replace, the more important that supplier becomes from a risk perspective.

How to prioritize suppliers based on risk

This is where most teams get stuck — not because they cannot assess suppliers, but because they cannot assess all suppliers with the same level of effort. The goal of a supplier risk assessment is not to treat every supplier equally. It is to identify which suppliers deserve the most attention.

Quick test. If a supplier experienced a security incident tomorrow: would operations stop? Would customers be affected? Would sensitive information be exposed? Would regulatory obligations be triggered? The more often you answer yes, the higher the supplier should appear on your review list.

Supplier risk assessment example

Imagine your organization uses a cloud hosting provider to run a customer-facing application. The supplier stores customer information, supports a critical business service, and has administrative access to the environment. Using the assessment criteria discussed earlier, the review might look like this:

This supplier would likely be classified as a Critical supplier — not because it lacks security controls, but because of the potential impact of a security incident. A supplier risk assessment should evaluate both security maturity and business impact. Strong security controls do not automatically mean low supplier risk. A critical supplier would typically receive more frequent reviews, additional evidence requests, greater management oversight, stronger contractual security requirements, and ongoing monitoring of significant changes.

Supplier risk assessments are only one part of NIS2 readiness. If you’re building a broader compliance program, read our NIS2 Incident Response Plan Template, which explains how organizations prepare for the 24-hour reporting requirement and document incident response procedures.

Common supplier risk assessment mistakes

1. “We assess every supplier the same way.” The result is usually predictable: too much effort spent on low-risk suppliers and not enough on the vendors that matter most.
2. “They have ISO 27001, so we’re covered.” Certifications are useful, but a supplier can have strong security practices and still create significant risk because of the role they play in your business.
3. “We reviewed them when we signed the contract.” Services change, access expands, suppliers acquire other companies, and subcontractors enter the picture. The supplier you approved three years ago may not be the same one you rely on today.
4. “We know why they’re high risk.” Maybe you do — but will the next person reviewing the assessment know? If the rationale only exists in someone’s head, the assessment becomes hard to defend and repeat.

One thing that often gets missed is who the supplier depends on. A vendor may appear low risk until you discover that key parts of their service are delivered by other providers you have never assessed. The best supplier assessments are usually the simplest — they help you answer one practical question: “If this supplier had a serious security incident tomorrow, how much would it affect us?”

Final thoughts

Most organizations already know who their suppliers are. The harder question is which suppliers create the most risk. A supplier risk assessment helps teams focus on the vendors that matter most, apply consistent criteria, and make decisions that can be explained and documented later.

FAQ

How often should supplier risk assessments be reviewed?

It depends on the supplier’s risk level. Critical suppliers are often reviewed annually, while lower-risk suppliers may be reassessed every two or three years.

What makes a supplier high risk?

Suppliers that support critical services, access sensitive information, or have privileged access to systems typically require additional scrutiny and more frequent reviews.

Are certifications enough to assess supplier risk?

No. Certifications can support an assessment, but they do not replace reviewing business impact, system access, dependencies, and operational risk.

What is the difference between supplier risk and vendor risk?

The terms are often used interchangeably. Both refer to the risks introduced by third parties that provide products, services, or operational support.

Who should be involved in a supplier risk assessment?

Security, IT, risk, compliance, procurement, and business owners often contribute because supplier risk affects more than cybersecurity alone.

What is the biggest mistake in supplier risk assessments?

Treating all suppliers the same. The most effective assessments focus attention on suppliers that create the greatest business and cybersecurity risk.