MyCISO Supplier Assessment — High Criticality Compliance

Overview

MyCISO Supplier Assessment — High Criticality provides the most rigorous assessment for vendors presenting the greatest risk.

It covers 80+ questions spanning security governance, access management, data protection, network security, incident response, business continuity, compliance, and supply chain management.

Suppliers must provide comprehensive evidence packs, and independent verification through audit reports or on-site assessment may be required.

Recommended review cadence is every 6-12 months with ongoing monitoring between assessments.

Part of a three-tier supplier assessment framework: Low, Medium, and High Criticality.

Key Areas

• Security governance: board-level security oversight, CISO or equivalent role, security strategy, and programme maturity
• Access management: privileged access controls, identity management, MFA, session management, and least-privilege enforcement
• Data protection: classification, encryption standards (at rest, in transit, in use), key management, data residency, and secure disposal
• Network and infrastructure security: segmentation, intrusion detection, DDoS protection, and secure architecture
• Application security: secure development lifecycle, code review, penetration testing, and vulnerability management
• Incident response: documented plans, defined SLAs for notification, forensic capability, and post-incident review
• Business continuity and disaster recovery: RTOs, RPOs, tested DR plans, geographic redundancy, and failover capability
• Compliance and certifications: ISO 27001, SOC 2 Type II, PCI DSS, or equivalent certifications and audit reports
• Third-party and subcontractor management: the supplier's own supply chain assessment practices
• Legal and contractual: data processing agreements, liability provisions, right-to-audit clauses, and exit provisions
• Personnel security: background screening, security clearances where applicable, and ongoing training
• Change management: structured change control processes for systems and configurations affecting your data or services

Who It's For

• Security teams responsible for assessing critical vendors with access to sensitive data or systems
• Third-party risk management teams building or maturing supplier oversight programmes
• Compliance managers meeting regulatory requirements for critical supplier assessment (APRA, ISO 27001, NIST)
• Procurement and vendor management teams evaluating or onboarding high-risk suppliers

Core Requirements

Policies and Governance

The supplier must demonstrate mature security governance: documented policies reviewed at least annually, board or executive-level security oversight, a designated CISO or security lead, and evidence of a structured security programme. Policy documents must be provided as evidence.

Risk Management

The supplier should maintain a formal risk management process including a risk register, regular risk assessments, and documented risk treatment decisions. The assessing organisation should review the supplier's risk appetite and residual risk positions relevant to the services provided.

Security Controls

Comprehensive technical controls are assessed: access management, encryption, network security, endpoint protection, vulnerability management, application security, logging, and monitoring. Evidence must be provided for all critical controls, and independent verification (SOC 2 report, penetration test results) may be required.

Incident Response

The supplier must have a mature incident response capability including a documented plan, defined roles, notification SLAs (typically 24-72 hours for material incidents), forensic investigation capability, and evidence of regular testing through tabletop exercises or simulations.

Evidence and Reporting

High Criticality assessments require a comprehensive evidence pack: policy documents, certification copies, recent audit reports (SOC 2 Type II, ISO 27001 surveillance), penetration test executive summaries, DR test results, and training records. Independent verification through audit reports or on-site assessment may be required.

Implementation Steps

1. Classify and scope - Confirm High Criticality classification using your criticality matrix: extensive access to sensitive data, deep system integration, critical operational dependency, or privileged access to your environment. Define the scope of assessment based on the specific services and data involved.
2. Issue the assessment - Send the MyCISO High Criticality questionnaire through the Suppliers module. The 80+ question assessment includes evidence upload requirements for all major domains. Allow 2-4 weeks for supplier completion.
3. Evidence review - Conduct a thorough review of responses and supporting evidence. Validate certifications, review audit reports, assess penetration test findings, and evaluate the maturity of governance and operational controls.
4. Independent verification - Where gaps exist or assurance is insufficient, request additional verification: current SOC 2 Type II report, ISO 27001 certificate and statement of applicability, recent penetration test results, or schedule a virtual/on-site assessment.
5. Risk assessment and remediation - Document residual risks, agree on remediation plans for critical gaps, and define contractual security requirements and SLAs based on assessment findings. Establish monitoring triggers and escalation procedures.
6. Ongoing monitoring - Establish continuous or periodic monitoring: reassessment every 6-12 months, tracking of remediation commitments, monitoring of supplier security posture through threat intelligence and incident feeds, and contractual review triggers.

Frequently Asked Questions

What makes a supplier high criticality?

A supplier is high criticality when they have extensive access to sensitive data, are deeply integrated into your systems, provide services critical to operations, or hold privileged access to your environment. Examples include cloud infrastructure providers, managed security services, payroll processors, and core banking system vendors.

Can a SOC 2 Type II report replace this assessment?

A SOC 2 Type II report provides strong assurance and can satisfy many assessment questions. However, it should be supplemented with relationship-specific questions: how your data is handled, subcontractor use, incident notification commitments, and exit provisions.

How often should high-criticality suppliers be reassessed?

Every 6-12 months for formal reassessment, with continuous monitoring of security posture between assessments. Material changes in the supplier relationship or a security incident should trigger ad hoc reassessment.

What if the supplier refuses to provide evidence?

For high-criticality suppliers, refusal to provide evidence is a serious risk signal. Options include accepting residual risk with executive sign-off, implementing compensating controls, negotiating contractual requirements, or evaluating alternative suppliers.

Do we need to conduct on-site assessments?

Not always. On-site or virtual assessments are recommended when evidence review is insufficient, when the supplier handles particularly sensitive data, or when gaps identified in the questionnaire require direct verification. The decision should be risk-based.

Is this a recognised standard?

No. This is a proprietary MyCISO framework incorporating best practices from ISO 27001 Annex A.15, NIST CSF ID.SC, APRA CPS 234 third-party requirements, and established enterprise supplier assessment methodologies.

Why It Matters

• High-criticality suppliers represent concentrated risk. A single breach at a cloud provider, managed security service, or payroll processor can expose the organisation to regulatory penalties, litigation, reputational damage, and operational paralysis. Rigorous assessment is essential to manage this risk.
• Regulatory frameworks increasingly hold organisations accountable for their critical suppliers' security practices. APRA CPS 234, ISO 27001, NIST CSF, and GDPR all include requirements for proportionate supply chain oversight, with the highest expectations applied to the most critical relationships.
• The assessment creates a structured basis for contractual security requirements, SLA definitions, and ongoing monitoring. Rather than relying on generic terms and conditions, organisations can negotiate specific security commitments grounded in the assessment findings.

Common Challenges

• High-criticality suppliers may resist detailed assessments, particularly large vendors who serve many customers
• Obtaining and reviewing comprehensive evidence packs is resource-intensive for both parties
• Negotiating right-to-audit clauses and security SLAs with suppliers who hold bargaining power
• Maintaining ongoing monitoring discipline beyond the initial assessment
• Reconciling assessment findings with contractual leverage — critical suppliers may be difficult to replace even if gaps are identified
• Coordinating assessment timelines with supplier availability, particularly for on-site or independent verification