ISO 27001 supplier assessment
Supplier assessment for ISO 27001 that convinces the auditor
We map your suppliers, divide them into risk categories and assess them as the external auditor expects. This way you have control over your supply chain and a complete record.
- No endless questionnaires, but a thorough test with a high risk
- Complies with the supplier measures 5.19 to 5.23 from Annex A
- Critical suppliers assessed within six weeks
Trusted by 500+ companiesCertified lead auditorsAlso for the Cyber Security Act
The lines of communication with Nestor Security were short. The organization is pragmatic and a down-to-earth party to do business with.
Pascal KamphuisCorpoflow
Schedule a no-obligation consultation
One of our ISO 27001 experts will contact you within one working day. We will discuss your suppliers, the approach and the costs.
How can we help you?
Response from an ISO 27001 consultant within one working day. Free of charge and without sales talk.
Find out why 500+ Companies trust Nestor Security for IT security and compliance
Who assesses your suppliers?
You can also assess suppliers yourself, using a standard questionnaire or software. These are the differences that make a difference during the audit.
| Nestor Security | Self-administered with a standard questionnaire | Platform for supplier management | |
|---|---|---|---|
| Approach | Risk-oriented, with a thorough assessment only where the risk is high | The same long questionnaire for each supplier | Standard questionnaires from the software |
| Assessment | Answers and evidence are factually reviewed by a lead auditor | Answers are collected, but rarely evaluated | Automatic scores based on self-reporting |
| Certificates | Scope, validity and Declaration of Applicability checked | A certificate is often accepted without any questions. | Upload of the certificate, without substantive review |
| Contracts | Missing security arrangements appointed and proposed | Often out of focus | Usually outside the scope |
| Your suppliers | Short questionnaires where they actually answer the questions | Low response rate due to long questionnaires | Another platform where they have to log in |
| Evidence for the auditor | Register, files and planning as the auditor wants them to be | Individual files and emails | Reports in the software |
| Costs | Fixed price, no additional charges | Many internal hours | Annual license |
Take control of your suppliers, as the auditor wants it
After the assessment, you will know which suppliers are under criticism, where the risks lie and what agreements still need to be completed. Everything is recorded in a register that you can keep track of yourself.
- A register of all your suppliers, including the cloud services that have been purchased outside IT
- A classification into risk classes with established criteria
- An assessment file per critical supplier, with findings and recommendations
- A plan for reassessment and a method that you can repeat yourself
Management of servers and workstationsCriticismActions open
Hosting the client environmentCriticismApproved
Processed personnel dataHighSupplementing the contract
Customer data in the cloudHighApproved
Access to the officeLowLight check
This is how the supplier assessment works
In four steps and an average of six weeks. We take care of the contact with your suppliers, so your team doesn't have to spend much time on it.
Inventory
- All suppliers are included, including cloud services that were purchased outside of IT
- For each supplier, it is specified which information and systems are affected
- One owner per supplier relationship
Classification by risk
- Fixed criteria for access to data, dependencies and substitutability
- Classification into critical, high, medium and low
- By risk class the depth of the assessment
Assessment
- Certificates checked for scope and validity
- Short, customized questionnaires, content-tested
- Contracts and processing agreements are in line with security agreements
- A conversation or audit at the supplier’s premises for critical suppliers
Report and collateral
- Findings and advice per supplier
- Agreements on improvement actions with the supplier
- A plan for reassessment
- Workflow and templates so you can keep track of it yourself
Ready for the audit
Your supplier management complies with measures 5.19 to 5.23 in Annex A and with clause 8.1 of the standard. You will henceforth assess critical suppliers annually, and again when there are significant changes in their services.
This is what the auditor wants to see in supplier management
You can outsource services, but the responsibility for security remains with you. Therefore, the auditor examines five measures that apply to suppliers, and the way you demonstrate them.
Supplier Relations
A standard procedure for selecting and evaluating suppliers.
Agreements in contracts
Security requirements, a reporting obligation for incidents and the right to inspect.
The ICT chain
View of the suppliers of your suppliers, where the risk lies.
Monitoring and reassessment
Periodic assessments and attention to changes in the service provided.
Cloud services
Agreements regarding the selection, use and termination of cloud services.
Outsourced processes
Processes that you have outsourced are also within the scope of your ISMS management.
Complete overview
All suppliers with service, owner, risk class and status.
Recorded reviews
For each supplier, demonstrable evidence of what has been assessed, when and with what outcome.
Also the basis for the chain obligation under the Cyber Security Act
Since August 15, 2026, the Cybersecurity Act requires demonstrable control over the security of your supply chain. According to ENISA, this is precisely the weakest point in organizations’ preparations. A supplier assessment according to ISO 27001 covers a large part of those requirements.
Success story of Effectory
Feedback analytics developers with a team of more than 250 people
Months before a project with ISO 27001 and ISO 27701
New security measures implemented
Success during the external audit
The challenge
Effectory processes sensitive employee data for over 1,200 organizations. The challenge was to continuously strengthen the information security system and have it grow with the high demands of customers, without disrupting daily services.
The approach
In close collaboration, we have refined the management system for both ISO 27001 and ISO 27701. With a dedicated point of contact, responsibilities have been clearly defined, processes secured, and the organization prepared for the external audit to achieve certification.
The outcome
Within 6 months, Effectory achieved ISO 27001 certification without any bottlenecks. Security is now demonstrably in order for customers, security questionnaires are answered more quickly, and a solid, future-proof foundation is in place.
Nestor Security conducted the internal audits for both ISO 27001 and ISO 27701 for us. They really strike the right chord for us with a great combination of quality and feasibility. They are pragmatic, think along well with our needs, and the audits are well-organized.
Wouter BuzingCISO, Effectory
Send out questionnaires, or really get a grip on your suppliers
A data breach at a supplier quickly becomes your data breach. For example, customer data was leaked at several large Dutch organizations via the software provider of a market research agency. An annual questionnaire alone provides only a semblance of certainty.
Send out self-administered questionnaires
A lot of work, little certainty
Met Nestor Security
Risk-oriented, substantiated and demonstrable
Need help with the rest of your ISMS too?
Supplier management is one of the 93 measures in Annex A. We also guide the full implementation, from zero measurement to certification, on average in 4 to 5 months.
Don't just take it from us
You are in good company with Nestor.
The communication lines with Nestor Security were short. The organization has a pragmatic mindset and is a down-to-earth party to do business with. As a result, the process went smoothly and fairly quickly.
We prefer to work together as much as possible regionally and like to hold meetings face-to-face. When you look at partners in the North, there are still a few left, and Nestor Security stands out above the rest.
Nestor Security has provided the internal audits of ISO 27001 and ISO 27701 for us. They really hit the mark for us with a good combination of quality and practicality. They are pragmatic, think well with our needs, and the audits are well-managed.
Your questions answered
FAQs
How much time does our own team take?
Especially at the start, for the inventory and classification into risk categories. Expect a few short sessions with IT, purchasing, and the owners of the most important supplier relationships. We take care of the contact with the suppliers themselves.
What if a supplier does not cooperate?
This happens, especially with large suppliers. We then work with what is publicly available, such as certificates, reports, and security documentation, and determine what residual risk remains.
This way, you can show in the audit that you made a conscious decision.
Does this also apply to the Cyber Security Act?
Yes. Since August 15, 2026, the Cyber Security Act has called for attention to the security of the supply chain. A supplier assessment according to ISO 27001 covers a large part of it.
We incorporate the topics from the law, such as agreements on reporting incidents, directly into our work.
Do we have to evaluate all our suppliers?
All of them are covered in the report, but not all in the same depth. The standard requires an approach that fits the risk. A supplier that manages your customer data deserves a thorough assessment. A brief check from your office supplies supplier is sufficient.
With a fixed classification into risk categories, you can explain that choice to the auditor.
What does ISO 27001 require of supplier assessment?
ISO 27001 includes five measures regarding suppliers, 5.19 to 5.23 in Annex A. You specify how you select and assess suppliers, what security arrangements you make with them, how you manage the ICT chain and cloud services, and how you periodically reassess suppliers.
In addition, clause 8.1 requires that outsourced processes also fall under the control of your ISMS.
What determines the price of a vendor assessment?
Especially the number of suppliers and how many of them are critical. After the first conversation, you will receive a fixed price, without any additional charges.
How often do we need to reassess suppliers?
Critical suppliers are reviewed annually; less important suppliers are reviewed once every two or three years. Additionally, you reassess when major changes occur, such as a supplier acquisition, a new service, or a security incident.
Is an ISO 27001 certificate from the supplier enough?
Often not. A certificate only says something about the scope that is stated on it. We check whether the service you are receiving falls within that scope, whether the certificate is valid, and whether it was issued by an accredited institution.
We also read the contents of a SOC 2 report or ISAE 3402 statement, including the exceptions that the auditor of the supplier found.
Know which suppliers pose the greatest risk to you
Schedule a free consultation. You will receive a response within one business day and a fixed price after the consultation, without additional charges.
Schedule a no-obligation consultationSee what you get
Annex A 5.19 to 5.23Also for the Cyber Security ActCertified lead auditors