Third-party cyber-risk management helps organisations identify which suppliers can materially affect security or resilience and apply proportionate controls throughout the relationship lifecycle. The service supports procurement, risk, legal, security and business owners that need consistent supplier decisions instead of one-size-fits-all questionnaires.
It exists to move you from regulatory uncertainty to decisions with clear owners, budget and evidence.
The exact boundaries are settled before the engagement begins. Depending on the objective, environment and authorised access, the engagement may cover:
Define governance, tiering, evidence standards, decision rights and integration with procurement.
Assess business criticality, data sensitivity, technical access and substitutability.
Use targeted evidence and validation rather than relying only on self-declared questionnaires.
Assign remediation, exceptions, clauses and acceptance decisions.
Set reassessment triggers, incident coordination and termination controls.
Reports serve decision-makers and implementation teams alike. Depending on scope, they may include:
CTG confirms the decision to be supported, the evidence threshold, responsible stakeholders and the distinction between advisory work, implementation, legal interpretation and independent assurance. Findings are linked to owners, dependencies and measurable next actions.
The engagement may draw on ISO/IEC 27036, NIST Cybersecurity Supply Chain Risk Management guidance, NIS2 and DORA requirements where applicable. Naming a framework indicates our approach; it does not constitute certification, accreditation or a regulatory decision.
Duration is agreed after scoping and depends on environment size, available evidence and stakeholder availability.
A supplier assessment is a point-in-time risk decision based on available evidence. It does not guarantee that the supplier is secure or continuously compliant. Legal review is required for contractual language, regulatory interpretation and cross-border issues.
Discuss Third-Party Cyber Risk Management with CTG. We start with a scoping conversation to fix the objective, limits, evidence, delivery model and deliverables ahead of any proposal.
The exact boundaries are settled before the engagement begins. Typical areas include supplier inventory, ownership and criticality criteria, Pre-contract cybersecurity due diligence, Data, access, hosting, subcontractor and operational dependencies, and Contract clauses, notification, audit and evidence rights. Scope limits, access needs, client responsibilities and acceptance criteria are captured in the proposal.
Deliverables depend on the agreed objective and may include third-party cyber-risk policy and operating model, Supplier inventory and risk-tiering method, Due-diligence questionnaires and evidence standards, and Assessment reports and decision records. Findings are traceable to evidence, impact, priority and the person responsible for acting.
CTG normally requests the policies, registers, governance records, technical evidence and previous assessments relevant to the agreed scope. The evidence request is tailored so that the customer does not collect material that will not be used.
No. CTG provides cybersecurity assessment and implementation support within the agreed scope. Formal legal interpretation, statutory assurance and accredited certification remain separate.
Duration is agreed after scoping and depends on environment size, available evidence and stakeholder availability.
The two cover connected yet different problems. Scoping identifies whether Third-Party Cyber Risk Management, DORA Operational Resilience Programme, or a coordinated programme is the smallest useful approach without duplicating work.
A supplier assessment is a point-in-time risk decision based on available evidence. It does not guarantee that the supplier is secure or continuously compliant. Legal review is required for contractual language, regulatory interpretation and cross-border issues.
