Rating Suppliers by Data and Access
Not every supplier needs the same review. A simple tier model, based on the data a supplier holds and the access it has, puts your effort where the risk really is.
In this article
Most companies rely on dozens of suppliers: cloud platforms, SaaS tools, payment providers, outsourced developers, agencies and consultants. Some of them hold sensitive data or connect deep into your systems. Others never touch anything that matters. Treating them all the same wastes effort and misses real risk.
A tier model solves this. You rate each supplier by the data it holds and the access it has, then match the depth of review to the tier. This guide explains a simple model that works for growing companies.
1. Why tiers beat a single checklist
Many teams start third-party risk management with one long questionnaire for every supplier. It feels thorough, but it rarely works. Small suppliers struggle to answer it, important suppliers answer it in a hurry, and the security team drowns in responses it cannot read properly.
Tiers fix the balance. A supplier that hosts your production database deserves careful review. A supplier that sells you office chairs does not. By sorting suppliers first, you spend your limited time where a failure would hurt most. Auditors for frameworks such as ISO 27001 and SOC 2 also expect supplier risk to be managed in proportion to the risk, so a tier model helps there too.
Tiers also make conversations with suppliers easier. A small supplier in the standard tier will appreciate not receiving a long questionnaire, and a critical supplier will understand why you ask for more. Being clear about the reason for each request builds goodwill on both sides.
2. A simple three-tier model
Two questions drive the model. What data does the supplier handle? What access does it have to your systems? The answers place each supplier in one of three tiers.
| Tier | Typical supplier | Data and access | Depth of review |
|---|---|---|---|
| Critical | Cloud hosting, core SaaS, payment processing | Holds sensitive or large volumes of data, or has deep access to your systems | Full review before signing and regular reviews after |
| Elevated | Support tools, analytics, some contractors | Limited data, or limited access to specific systems | A standard questionnaire and a check of key documents |
| Standard | Office supplies, general services | No access to your data or systems | A light check of basic terms |
Keep the criteria simple and written down, so that different people reach the same tier for the same supplier. When in doubt, choose the higher tier and adjust later.
The tier also shapes the contract. Critical suppliers usually need stronger terms on security, breach notification, audit rights, subcontracting and the return or deletion of data at the end of the relationship. Standard suppliers usually do not.
3. Running the model in practice
Start with an inventory. List your suppliers from finance records, procurement, single sign-on and conversations with team leads. For each, note the owner inside your company, the service provided, the data involved and the access it has. Many companies find suppliers they had forgotten about.
Next, assign a tier to each supplier using your written criteria. Begin with the suppliers you already suspect are critical. You do not need to finish the whole list before acting on the most important ones.
Involve the people who buy services. Procurement and team leads usually know first when a new supplier is coming. A short step in the buying process that asks about data and access lets you assign a tier before the contract is signed, while you still have room to negotiate.
For critical suppliers, gather evidence. A current SOC 2 report or ISO 27001 certificate helps, but read it rather than filing it. Check that the scope covers the service you actually use, and look for exceptions in a SOC 2 report. Ask follow-up questions where something is unclear.
Build review into the relationship, not just the start. Set a review rhythm by tier, such as yearly for critical suppliers, and review again when something changes: a new type of data, a new integration or a security incident at the supplier.
Do not forget the end of the relationship. When you stop using a supplier, revoke its access and confirm what happens to your data. An old integration that still has access is a common and avoidable risk.
Finally, keep the records simple. A clear register with each supplier, its tier, its owner, the last review date and any open actions is often enough for a growing company. Our article on third-party risk management, from blind spots to baselines covers the wider programme.
If you want help setting up a tier model and reviewing your critical suppliers, our third-party risk management team would be glad to help.