Understand the risk beyond your organisation.
Build a clearer view of the suppliers, services and dependencies your business relies on. Cybergen helps you assess third-party security and make informed decisions from onboarding through to renewal and exit.
Illustrative example only, not live data
Security oversight across your supplier lifecycle
Suppliers can hold sensitive information, administer important systems or support services your business cannot easily replace. Their security and resilience can affect your organisation even when your own controls are well managed.
Effective third-party risk management makes those dependencies visible. We help you apply the right level of scrutiny to each relationship, focus on evidence that matters and establish a practical process for reviewing risk as services and circumstances change.
Your suppliers are part of your attack surface
of breaches involved a third party, according to Verizon's 2025 Data Breach Investigations Report
the rate of third-party involvement in breaches compared with the previous year's report
of UK businesses review the cyber security risks posed by their immediate suppliers
Sources: Verizon 2025 Data Breach Investigations Report; UK Government Cyber Security Breaches Survey 2025
Which tier is this supplier?
Think of one supplier and answer four questions. This is a simplified version of the criticality model we build with you.
We will suggest a proportionate level of assurance.
Build our supplier modelOversight from onboarding to exit
Supplier risk changes after the contract is signed. We help you build review points into every stage.
Inventory suppliers, owners, data and access.
Proportionate questions before you commit.
Security terms, rights to audit and notification duties.
Track actions, incidents and evidence over time.
Reassess on renewal, incidents or new services.
Remove access, return or delete data, keep continuity.
A certificate is not the whole answer
Certification is useful evidence, but scope and detail matter. Select each marker to see what we check.
Does it cover the service you use?
A certificate may only cover one site, product or team. Check that the scope statement includes the service, location and data you rely on.
Is it current?
Check the issue and expiry dates, and whether surveillance audits have taken place. An expired or lapsed certificate tells you little about today.
What was left out?
The Statement of Applicability shows which controls were excluded and why. Exclusions that matter to your use of the service need follow-up.
Who issued it?
Look for a certification body accredited by a recognised accreditation body, such as UKAS in the UK.
Fictional certificate for illustration
Six areas of supplier oversight
Supplier discovery and criticality
Build or refine a supplier inventory. Identify access, data handling and service dependencies, then tier relationships according to their potential business impact.
Pre-contract due diligence
Assess proposed suppliers before important commitments are made. Tailor questions and evidence requests to the service, information and access involved rather than using the same checklist for every relationship.
Security evidence review
Review supplied policies, assurance reports, testing summaries and other relevant evidence. Consider scope, age, exceptions and applicability, rather than treating a certificate as a complete answer.
Risk decisions and remediation
Record material findings and agreed actions. Support business owners in deciding whether to proceed, request improvements, apply additional controls or select another arrangement.
Ongoing reviews and change
Establish reassessment triggers around criticality, renewal, incidents and material service changes. Track outstanding actions and maintain visibility of accepted risks.
Concentration, subcontractors and exit
Examine reliance on shared providers and important downstream dependencies. Review access removal, information return or deletion, and continuity arrangements when a relationship ends.
Supplier risk is now a regulatory expectation
We align your approach with the obligations and frameworks that apply to you.
Financial entities must manage ICT third-party risk, keep a register of information and include specific contract provisions.
In-scope organisations must address supply chain security, including the security practices of direct suppliers.
Proposed UK legislation that would bring more managed service providers and critical suppliers into scope.
Annex A includes controls for supplier relationships, supplier agreements and the ICT supply chain.
Practical principles for understanding, controlling and improving supply chain security.
Clear outputs. Practical next steps.
- A supplier risk model and agreed criticality tiers.
- Assessment templates and evidence requirements proportionate to each tier.
- Supplier findings, remediation actions and documented decision records.
- A review schedule and practical onboarding, change and exit procedures.
A cycle, not a one-off
Supplier risk is reviewed again whenever the relationship or exposure changes.
Identify priority suppliers, service owners and information flows.
Review evidence and discuss gaps with the appropriate stakeholders.
Document risk treatment, ownership and any conditions for acceptance.
Track actions and reassess when the relationship or exposure changes.
Should every supplier receive the same assessment?
No. Assessment effort should reflect the service’s importance, the access involved and the information at risk. A critical outsourced service needs different scrutiny from a low-impact supplier.
Is supplier certification enough?
Certification can provide useful evidence, but its scope and relevance matter. We consider whether it covers the service you use and which risks still need to be addressed.
Can this work with our procurement process?
Yes. The process should support procurement and business owners with clear review points, responsibilities and escalation routes. We help fit risk assessment into existing decisions.
What is a fourth party?
A fourth party is a supplier to your supplier, such as the cloud platform or software your provider relies on. Their failures can affect you even though you have no contract with them.
How often should suppliers be reassessed?
It depends on criticality. Critical suppliers are usually reviewed at least annually and whenever there is a renewal, incident or significant change. Low-impact suppliers may only need checks at onboarding and renewal.
Make supplier risk a clear business decision.
Understand your critical dependencies and establish proportionate assurance throughout the supplier lifecycle.
Thanks, we've received your enquiry
A member of our team will be in touch shortly.