MyCISO Supplier Assessment — Medium Criticality Compliance

Overview

MyCISO Supplier Assessment — Medium Criticality provides a balanced assessment for vendors presenting moderate risk.

It covers access management, data protection, incident response, business continuity, governance, and third-party management across 40-50 questions.

Suppliers provide self-attestation responses plus evidence for key controls such as policies, certifications, and encryption standards.

Recommended review cadence is every 12 months, with remediation tracking for identified gaps.

Part of a three-tier supplier assessment framework: Low, Medium, and High Criticality.

Key Areas

• Access management: how the supplier controls access to your data and systems, including role-based access, MFA, and joiners-movers-leavers processes
• Data protection: encryption at rest and in transit, data classification, retention policies, and secure disposal
• Incident response: documented incident response plan, breach notification commitments, and post-incident review processes
• Business continuity: disaster recovery plans, recovery time objectives, and tested restoration procedures
• Security governance: information security policies, designated security ownership, and management oversight
• Vulnerability management: patching cadence, vulnerability scanning, and remediation tracking
• Third-party management: whether the supplier subcontracts work and how they assess their own supply chain
• Compliance and certifications: relevant certifications (ISO 27001, SOC 2) and regulatory compliance status
• Physical security: controls over premises where data is processed or stored
• Employee security: background checks, security awareness training, and acceptable use policies

Who It's For

• Security teams assessing vendors with access to sensitive data or critical business processes
• Procurement teams evaluating new suppliers for data-handling roles or system integrations
• Compliance managers meeting ISO 27001 or NIST CSF supply chain assessment obligations
• Risk managers building a proportionate supplier risk management programme

Core Requirements

Policies and Governance

The supplier should have documented information security policies reviewed and approved by management. A designated person should be accountable for security. Evidence of policy documentation is requested as part of the assessment.

Risk Management

The assessing organisation classifies the supplier based on data sensitivity, system access, operational dependency, and replaceability. The supplier should demonstrate basic risk awareness in their responses, even if a formal risk register is not required.

Security Controls

Controls are assessed across access management, encryption, patching, endpoint protection, network security, and data handling. Suppliers must provide self-attestation responses and supporting evidence for key controls such as MFA deployment and encryption standards.

Incident Response

The supplier must have a documented incident response plan that includes breach notification to your organisation within agreed timeframes. Evidence of the plan and confirmation of notification commitments are required.

Evidence and Reporting

Medium Criticality assessments combine self-attestation with targeted evidence requests. Suppliers should provide copies of key policies, certification evidence (if applicable), and confirmation of specific technical controls. Full evidence packs are not required.

Implementation Steps

1. Classify the supplier - Confirm the supplier's Medium Criticality classification using your criticality matrix. Typical criteria: access to sensitive or personal data, supports important business processes, moderate operational dependency, some system connectivity.
2. Issue the assessment - Send the MyCISO Medium Criticality questionnaire through the Suppliers module. The questionnaire includes approximately 40-50 questions with evidence upload fields for key controls.
3. Review and score - Review responses and evidence. Score the supplier's maturity across assessment domains. Identify gaps that require remediation, contractual mitigation, or acceptance based on residual risk.
4. Remediation and follow-up - For identified gaps, agree on remediation actions and timelines with the supplier. Document remediation plans in the MyCISO platform and track through to closure.
5. Record and schedule - Record the assessment outcome, residual risk decisions, and any contractual requirements. Schedule the next assessment — typically every 12 months for medium-criticality suppliers.

Frequently Asked Questions

What makes a supplier medium criticality?

A supplier is medium criticality when they access sensitive or personal data, support important business processes, or have some connectivity to your systems, but are not so critical that their failure would cause severe operational disruption. Examples include HR software providers, marketing platforms handling customer data, and managed IT support.

What evidence should suppliers provide?

Key evidence includes copies of information security policies, certification copies (ISO 27001, SOC 2 if held), confirmation of encryption standards, incident response plan summaries, and evidence of security awareness training.

How do we handle suppliers who refuse to complete the assessment?

For medium-criticality suppliers, refusal to engage is a risk signal. Options include accepting the risk with documented justification, requiring contractual security commitments, or considering alternative suppliers who are willing to demonstrate their security posture.

Can a SOC 2 report replace this assessment?

A current SOC 2 Type II report can substitute for many Medium Criticality assessment questions. However, you should still verify areas specific to your relationship: data handling, subcontractor use, and incident notification commitments.

Is this a recognised standard?

No. This is a proprietary MyCISO framework designed for practical supply chain risk management. It incorporates best practices from ISO 27001 Annex A.15, NIST CSF Supply Chain Risk Management, and established supplier assessment methodologies.

Why It Matters

• Medium-criticality suppliers often handle personal data, provide cloud services, or support operational workflows. A breach or failure at one of these suppliers can cause regulatory exposure, data loss, or business disruption that goes beyond inconvenience.
• This tier captures the vendors most likely to be questioned during a security audit or regulatory inspection. Having structured assessments on file demonstrates due diligence and supports compliance with ISO 27001 Annex A.15, NIST CSF ID.SC, and similar supply chain requirements.
• The assessment identifies specific gaps that can be addressed through contractual requirements, remediation plans, or compensating controls — turning the assessment from a compliance exercise into an active risk management tool.

Common Challenges

• Supplier fatigue from receiving assessments from multiple customers with different formats and expectations
• Obtaining timely and complete evidence from suppliers who may lack dedicated compliance resources
• Interpreting responses from suppliers who use different terminology or maturity models
• Managing remediation tracking across a large portfolio of medium-criticality suppliers
• Balancing thoroughness with practicality to maintain supplier cooperation and relationship quality
• Determining whether identified gaps require contractual mitigation, remediation, or risk acceptance