How to assess supplier cybersecurity

Start with the service and its access

A payroll adviser, a document platform and an IT maintenance provider create different dependencies. Consider the consequences of service interruption or misuse of their access, rather than judging risk by company size alone.

• Record the service and the relationship owner.
• Identify the data involved and any remote or administrative access.
• Consider interruption impact and how easily you could replace the service.

Request information proportionate to criticality

A supplier security questionnaire organises answers; evidence helps substantiate them. Ask for greater detail when a supplier has privileged access, sensitive data or a critical operational role.

• Ask about access management, updates, backups and incident handling.
• Check the scope and validity of supporting documents.
• Record unanswered questions and outstanding measures.

Read the DTS profile and assessment status

Search for the company in NALLAM and consult its public profile. You can invite suppliers from your panel to obtain their DTS. Read the aggregate score alongside the assessed areas and profile status.

An assessment in progress is provisional. Verified identity confirms control of the profile, not a NALLAM-verified cybersecurity assessment. A missing DTS means information is unavailable here; it does not automatically mean the supplier is insecure.

Use the result in your procurement decision

DTS can contribute to a supplier security review. Approval also depends on the service, access, requirements and agreed measures; a score alone does not replace that decision.

If a supplier with administrative access gives incomplete answers, document what is missing and who must review it. Reassess when the service, access or supplier situation changes.

Frequently asked questions