Review suppliers across the whole relationship
Prioritise critical dependencies, ask for relevant evidence, and plan monitoring and exit before a supplier fails.
Read guideGRC in context
Technology & service providers
Manage change, supplier dependencies and assurance requests.
Begin with your actual activities.
Map the service, customers, data flows, infrastructure and subcontractors. Distinguish your own obligations from contractual promises and customer assurance questionnaires. Changes to products, AI use, data access and hosting should trigger a scoped review before rollout.
Scope of this starter pack
General GRC for technology and service providers. Applicability depends on the service, jurisdiction, organisational role and contract. Customer questionnaires and voluntary frameworks do not by themselves establish legal duties or certify the service.
Your priorities
- Separate the provider’s own obligations from customer commitments and questionnaire requests.
- Track product changes, access, information flows and subcontractor dependencies to accountable decisions.
- Support security and resilience claims with evidence of the actual service, scope and reporting period.
Questions to start with
- Which customer assurance claim is supported by current evidence for the service actually supplied?
- What material product, AI, hosting or access change should trigger a scoped review before rollout?
- Which shared platform or subcontractor could disrupt several customer services at once?
- Can the team demonstrate recovery or exit capability rather than point only to a written plan?
Bring to the first review
- A service and dependency map identifying access, information and important subcontractors.
- An obligations record distinguishing law, contract and voluntary assurance commitments.
- Control-test and recovery records with service scope, period and limitations stated.
- Change approvals, accepted exceptions and verification of the conditions attached to rollout.
Make the first meeting useful
- Map one service from customer commitment through infrastructure, information flows and subcontractors.
- Test one significant assurance claim against its scope, evidence period and exceptions.
- Decide the approval conditions for the next material change and the evidence needed to verify them.
Relevant resources
Follow the evidence into the work.
Bring cyber risk into the board's decisions
Translate technical reporting into business exposure, accountable decisions and evidence of resilience.
Read guideTest controls and keep an evidence trail
Distinguish a policy being written from a control being designed well and operating consistently.
Read guideBuild an obligations register that changes the work
Connect each applicable requirement to a responsible owner, a practical control and evidence that it operates.
Read guideLeave the review with a useful record.
Identify the owner, the evidence you have, the gaps and the next decision. Keep the applicable source and scope beside any conclusion.