ICT Supplier Due Diligence Measures Risk Beyond Security Ratings Alone

A vendor rating can look precise and still hide the key question: what could this supplier relationship expose or interrupt? A generic score rarely distinguishes a data processor from an embedded software component or a provider supporting a critical workflow.

For ICT suppliers, measurement must explain the relationship behind the rating. NIST’s July 2026 due-diligence guide structures the inquiry around five lenses: foreign ownership, control, or influence (FOCI), provenance, resilience, foundational cyber practices, and supply-chain tiers. It offers guidance, not a universal score or regulatory requirement.

Why vendor risk measurement must separate facts from confidence

Vendor reviews often combine unlike inputs. A questionnaire records an assertion; an audit report provides scoped assurance for a period; an external rating reflects observable signals; a contract records commitments. Each informs a decision differently and has limits.

A composite number without its basis hides whether it reflects exposure, an evidence gap, a narrow audit scope, or a scoring-method change. A score may move even when the supplier has not changed, simply because evidence expired or the method changed.

Keep three things visible: the relationship’s consequence, evidence strength, and remaining uncertainty. Strong evidence does not make a critical dependency low-impact. Sparse evidence does not prove a supplier is unsafe; it means the decision has less support.

New York’s Department of Financial Services guidance from October 2025 advises covered entities to classify providers by factors such as access, data sensitivity, location, and operational criticality, and to validate information beyond questionnaires. It applies to entities covered by that regulation; other organizations should check their own obligations.

Use five due diligence lenses for ICT suppliers

Finalized in July 2026, NIST SP 1326 identifies five components for ICT supplier due diligence. Use them to find material unknowns, not as equally weighted controls or an automatic 0–100 score. Their relevance depends on the supplier’s role and intended use.

Foreign ownership control or influence

Assess whether foreign ownership, control, or influence (FOCI) could affect supplier operations, product decisions, or access to information. Ownership or location alone is not a risk score. Consider whether legal, geopolitical, governance, or concentration conditions could affect confidentiality, availability, or delivery, then record which decision those facts inform.

Provenance

Establish what product or component the organization relies on and what is known about its origin and maintenance. For software, examine how it is built, updated, supported, and distributed, including whether material components are known. Match depth to role: a routine purchase does not need the scrutiny of software embedded in a critical system.

Resilience

Assess whether the supplier can restore the capability the organization depends on and whether the business can operate during an interruption. Compare recovery commitments with business needs and identify shared dependencies that could undermine a fallback. A documented plan shows preparation, not that your recovery path will work.

Foundational cyber practices

Assess safeguards relevant to the supplier’s access and role, such as identity controls, vulnerability handling, secure development, incident response, and data protection. Before relying on a certificate, questionnaire, or rating, verify its scope, dates, exclusions, and covered systems.

Supply-chain tiers

Look beyond the contracting entity when downstream parties can materially affect the product. Identify dependencies that could change the decision, such as shared hosting, a critical component, or a support provider with access. State where visibility ends; an incomplete map is not full assurance.

Turn evidence into a decision instead of a single number

For each lens, record the finding, source and date, scope, evidence confidence, and consequence for intended use. Connect the finding to a decision: proceed, add a safeguard or time-bound condition, seek more evidence, choose an alternative, or decline the use case.

Separate business impact, assessed risk and evidence confidence. High impact with strong evidence still requires scrutiny of the actual findings and safeguards; high impact with limited evidence creates additional uncertainty. Use impact and confidence to prioritize review effort. Neither combination establishes whether residual risk is acceptable.

Record evidence quality in terms reviewers can test: scope, date, independence, and whether the evidence covers the actual product or environment. A recent report can still omit a relevant component. A supplier statement can be precise but untested. These differences show which claims are supported and which remain assumptions.

Define impact using the organization’s existing business impact criteria: affected processes, data sensitivity, integrity consequences and maximum tolerable disruption. Record the assessed scenario and safeguards separately. Apply the same criteria across comparable uses; avoid inferring risk from supplier size or spend.

Describe evidence confidence as supported, limited or unknown. Supported means material claims have relevant, sufficiently current evidence with documented scope and validation. Limited means identified claims remain unverified or evidence has material scope or currency gaps. Unknown means there is insufficient information to assess support. These editorial categories describe assurance confidence, not control effectiveness or risk acceptance.

For any conditional approval, record intended use, affected scope, findings, residual risk, rationale, safeguards, action owner, deadline and acceptance expiry. The approver must have delegated authority for that risk level. Specify escalation when a condition fails, evidence changes or acceptance expires; do not let a temporary exception become indefinite permission.

Set decision gates for findings that should not be averaged away. Strong audit evidence cannot compensate for a recovery path the business has not tested when continuity is essential. A mature security program cannot erase a concentration exposure shared by critical dependencies. Define these gates before a review, then use scores to sort the remaining work.

Use quantitative analysis when scenarios, assumptions and estimates can be explained. Internal loss experience, relevant external data and structured expert estimates can inform frequency and loss ranges; internal incident data is not a prerequisite. Document uncertainty and test sensitivity to material assumptions. Do not convert ordinal scores into probabilities or precise financial amounts without a defensible model.

An illustrative supplier comparison

Consider two fictional providers of software used in finance. Provider A supplies current assurance evidence, but the workflow lacks a tested fallback and depends on one hosting layer. Provider B has thinner documentation, but the organization can use a manual process temporarily and has identified an alternative. This does not make B more secure; it shows why a score alone cannot set review priority.

Suppose A requests access to production finance data, but the review cannot establish recovery time for the relevant service. In this fictional decision, the authorized approver defers production use and permits a restricted pilot using synthetic data. The service owner must validate a usable export and continuity arrangement against the business tolerance before seeking expansion. A current assurance report does not resolve the recovery gap.

For B, the reviewer identifies the missing evidence: administrator authentication and access logging for the intended environment. A manual fallback reduces outage consequences but does not address confidentiality or integrity exposure. Production access remains deferred until sufficient evidence supports those safeguards and the authorized approver assesses residual risk. These are illustrative decisions, not actual supplier outcomes.

Reassess when an assumption changes

A vendor risk measurement is a dated view of a defined relationship. Revisit it when the supplier changes ownership or components, the organization adds sensitive data or privileged access, a key dependency shifts, or a disruption challenges the recovery plan. Test whether the decision still fits the use; do not refresh a score only because a date arrived.

NYDFS’s 2025 guidance addresses provider oversight across the relationship and notes that concentration or legacy dependencies can constrain switching. Other organizations may find these useful considerations, but obligations depend on applicable law, sector rules, and contracts.

Connect the assessment to governance evidence

A vendor assessment is more useful when its findings can be traced to internal risk decisions, control expectations, owners, and exceptions. SPOG.AI’s GRC solution describes connecting requirements, controls, operational evidence, accountability, and risk oversight. Its Continuous Control Monitoring solution connects defined controls with operational evidence to assess coverage and effectiveness. Its Exposure Management solution connects exposure with business, control, recovery, ownership, and workflow context.

Supplier findings should remain traceable to enterprise risk and control records. Use the systems appropriate to the program, with clear references between the due-diligence assessment, internal controls and risk acceptance decisions. Operational control evidence can support review but does not replace independent supplier assurance.

Make the measurement useful to the next decision

Start with suppliers embedded in critical technology or material business processes. Define the intended use, apply the five lenses, and record evidence and its limits. Ask what decision each finding changes. If it changes no action, approval condition, or contingency, reconsider collecting it.

Vendor risk measurement cannot promise certainty. It makes assumptions reviewable so security, procurement, legal, technology, and business owners can choose a proportionate response and revisit it when the relationship changes.

Frequently asked questions