Do you know which suppliers can access your systems, data or payments? 1. Do you know which suppliers can access your systems, data or payments?
No, we have no list and would need to ask around. We know the main ones informally, but nothing is written down. We keep a supplier access list with service, access, owner and renewal date, and review it regularly.
How do vendors usually get access to your systems? 2. How do vendors usually get access to your systems?
They use shared or owner logins, often with full admin rights. Some have their own accounts, but access is rarely limited or time-bound. Each vendor has a named account with only the access needed, MFA where possible, and an agreed end date.
What happens when a supplier relationship ends? 3. What happens when a supplier relationship ends?
Nothing specific; access often stays in place. We remove some access when we remember to. We follow a simple offboarding checklist: remove accounts, change shared passwords, recover data and record the date.
Have you agreed basic security expectations with your critical suppliers? 4. Have you agreed basic security expectations with your critical suppliers?
No, we have never discussed security with them. We have discussed it verbally with one or two suppliers. Critical suppliers have agreed in writing to incident notification, data handling and exit arrangements.
Is there a documented owner for the key control in this chapter? 5. Is there a documented owner for the key control in this chapter?
No / unknown Partially / informal Yes, documented and reviewed
Can the organisation provide current evidence that the control works? 6. Can the organisation provide current evidence that the control works?
No evidence Some evidence, not routinely checked Current evidence is reviewed
Are weaknesses tracked to an owner and target date? 7. Are weaknesses tracked to an owner and target date?
No consistent process Sometimes Yes, tracked to closure
Do employees know how to report a concern or incident? 8. Do employees know how to report a concern or incident?
No clear route Some employees know Clear route is communicated
Is this topic reviewed regularly and after significant changes? 9. Is this topic reviewed regularly and after significant changes?
Never / rarely Only after a problem Yes, with recorded review
See my result 0 of 9 answered