Third Party Risk Pack

Only a minority of small businesses ever review the security of their suppliers, yet the incidents that hurt most arrive through exactly that door: the IT provider with admin access, the payroll service holding your people's data, the SaaS tool nobody assessed. UK GDPR makes the point sharper. You may only use processors providing sufficient guarantees, and the regulator holds you primarily responsible for your processors' compliance.

This pack makes supplier security a process instead of a worry. List your suppliers from accounts payable, answer three questions per supplier, and the tiering formula sorts them into three levels of scrutiny. Tier 1 suppliers get a twenty-two question assessment with model good answers and red flags. Tier 2 and 3 get proportionate shorter versions. The twelve-clause contract library gives you the security terms to ask for at the next renewal, in plain language a supplier cannot pretend to misunderstand.

Customers increasingly push these requirements down their supply chain. This pack is how a small organisation answers credibly, and how a consultant runs supplier risk for every client from one instrument.