MyCISO Supplier Assessment — Low Criticality Compliance

Overview

MyCISO Supplier Assessment — Low Criticality provides a streamlined questionnaire for evaluating vendors with minimal risk exposure.

It covers basic cyber hygiene, data handling, incident notification, and business continuity through approximately 15-20 self-attestation questions.

Designed to be completed in under 30 minutes with no evidence uploads required.

Recommended review cadence is every 24 months, with reassessment triggered by material changes.

Part of a three-tier supplier assessment framework: Low, Medium, and High Criticality.

Key Areas

• Basic cyber hygiene: antivirus, firewalls, and automatic patching confirmed
• Data handling: confirmation that any shared data is stored securely and access is limited
• Business continuity: supplier has basic backup and recovery procedures
• Incident notification: supplier agrees to notify your organisation promptly if a breach occurs
• Insurance: confirmation of whether the supplier holds cyber insurance
• Regulatory compliance: supplier confirms compliance with relevant data protection laws
• Subcontractor awareness: supplier discloses whether subcontractors access your data
• Physical security: basic controls over premises where data may be accessed

Who It's For

• Security teams managing large supplier portfolios who need a proportionate assessment approach
• Procurement teams onboarding new vendors and needing a fast security screening
• Compliance managers demonstrating structured supply chain risk management to auditors
• Organisations implementing ISO 27001 or NIST CSF supply chain requirements

Core Requirements

Policies and Governance

The supplier should have a basic information security policy or acceptable use policy in place. Formal governance structures are not expected at this tier, but someone within the supplier organisation should be accountable for security.

Risk Management

No formal risk assessment is required from the supplier. The assessing organisation classifies the supplier as low criticality based on data access, system connectivity, and operational dependency criteria.

Security Controls

The assessment confirms basic controls: endpoint protection, firewall, patching, password policies, and data backup. These are verified through self-attestation questions rather than evidence review.

Incident Response

The supplier must confirm they have a process for detecting and responding to security incidents and that they will notify your organisation within an agreed timeframe if an incident affects shared data or services.

Evidence and Reporting

Low Criticality assessments are self-attestation-based. The supplier completes the questionnaire and a responsible person signs off on the accuracy of responses. No evidence uploads or independent verification are required.

Implementation Steps

1. Classify the supplier - Use your supplier criticality matrix to confirm the vendor falls into the Low Criticality tier. Criteria include: no access to sensitive or personal data, no direct network connectivity, and services are easily replaceable with minimal operational disruption.
2. Send the assessment - Issue the MyCISO Low Criticality supplier questionnaire through the Suppliers module. The questionnaire is pre-built with the appropriate questions for this tier — no customisation needed.
3. Review responses - Review the supplier's self-attestation responses. Flag any gaps in basic controls (missing antivirus, no backup, no incident notification process) for follow-up discussion.
4. Record and schedule review - Record the assessment outcome in the MyCISO platform. Set a review cadence — typically every 24 months for low-criticality suppliers, or triggered by a significant change in the supplier relationship.

Frequently Asked Questions

What makes a supplier low criticality?

A supplier is low criticality when they have no access to sensitive data, no direct connectivity to your systems, and their services could be replaced with minimal operational impact. Examples include office supply vendors, cleaning services, and non-technical consultants.

Is self-attestation sufficient?

For low-criticality suppliers, yes. The risk does not justify the cost of evidence review or on-site assessment. If a supplier's criticality increases, they should be reassessed under the Medium or High Criticality framework.

How often should low-criticality suppliers be reassessed?

Every 24 months is recommended, or sooner if the supplier relationship changes significantly — for example, if they gain access to new data or systems.

What if a supplier fails the assessment?

For low-criticality suppliers, a failed assessment typically triggers a conversation about remediation rather than immediate termination. If critical gaps cannot be addressed, consider whether the supplier relationship should continue.

Is this a recognised standard?

No. This is a proprietary MyCISO framework designed to support practical supply chain risk management. It draws on best practices from ISO 27001 Annex A.15, NIST CSF Supply Chain Risk Management, and industry supplier assessment standards.

Why It Matters

• Organisations often have hundreds of suppliers, and the majority are low criticality. Without a proportionate assessment framework, security teams either ignore these suppliers entirely or waste resources on full assessments that deliver diminishing returns.
• Even low-criticality suppliers can be exploited as initial access vectors if they have any connection to your environment. Confirming baseline security practices provides a minimum assurance threshold without over-engineering the process.
• Regulators and standards bodies increasingly expect organisations to demonstrate supply chain risk management. A tiered assessment approach shows a structured, risk-based methodology that satisfies audit expectations.

Common Challenges

• Suppliers may not respond promptly to assessments they perceive as low priority
• Self-attestation provides limited assurance — suppliers may overstate their controls
• Defining the boundary between low and medium criticality can be subjective without clear criteria
• Maintaining an up-to-date supplier register with accurate criticality classifications
• Ensuring assessment results are actually reviewed rather than just collected