Services

    Supplier Risk Management

    Your security is only as strong as your weakest supplier. We map, categorize, assess, and continuously monitor your entire supplier ecosystem - powered by the CISOteria Supply Chain module - so every supplier meets the cyber requirements that match its risk.

    Within the IPV methodology, this service delivers the ASSESS and COMPLY pillars across your supply chain.

    Why Supplier Risk Management Matters

    Attackers no longer need to breach you directly - they breach the suppliers you already trust. Without a managed program, every unassessed supplier is an open question in your risk picture.

    1

    60% of data breaches now involve a third party

    2

    Supplier ecosystems grow faster than your ability to assess them

    3

    NIS2, ISO 27001, BoI 361, and the Privacy Law all mandate it

    4

    Sending questionnaires is not a program - managing them is

    5

    Continuous external scanning catches what questionnaires miss

    Our Approach

    A fully managed supplier risk program - we own the process, the platform keeps it current, and your team keeps its focus.

    Full supplier mapping - including shadow vendors

    Risk-based categorization drives assessment depth

    Questionnaires sent, chased, and validated by us

    Each supplier directed to the right cyber requirements

    Continuous external attack-surface scanning

    Real-time visibility in the CISOteria Supply Chain module

    The IPV Methodology - how everything we do is delivered

    GOVERN Strategic leadership & program ownership
    ASSESS Continuous risk visibility
    PROTECT Controls implementation & hardening
    COMPLY Audit-ready at all times
    RESPOND Incident readiness & fast recovery
    See how the methodology works →

    Supplier Risk Programs

    Start with a structured program build, or hand us the whole program as an ongoing managed service.

    Supplier Risk Program Build

    A one-time project that maps your suppliers, classifies them by risk, assesses the critical ones, and hands you a working program - policy, register, questionnaires, and requirements - in weeks.

    Learn More

    Supplier Risk Management as a Service

    An ongoing retainer: new-supplier onboarding, questionnaire cycles, response validation, requirement enforcement, continuous external scanning, and executive reporting - run by IPV on CISOteria.

    Learn More
    500+
    Organizations served
    21+
    Years assessing Israeli vendors
    365
    Days a year of continuous supplier monitoring
    4–6
    Weeks to a working supplier risk program

    Our Supplier Risk Methodology

    The Managed Lifecycle

    Map Every Supplier

    Discovery across procurement, contracts, cloud spend, and shadow IT - building a Master Supplier Register in CISOteria.

    Categorize by Risk

    Every supplier is tiered - Critical, High, Medium, Low - by data access, system access, business impact, and regulatory classification.

    Send Tiered Questionnaires

    Risk-proportionate questionnaires from the CISOteria library - in Hebrew or English - with follow-up and escalation handled by IPV.

    Validate Every Response

    Analysts score and challenge responses, request evidence, and flag gaps - collecting answers is not the same as verifying them.

    Direct to the Right Requirements

    Each supplier receives the cyber requirements that match its tier - contractual clauses, controls, and remediation items tracked to closure.

    Scan External Interfaces Continuously

    Regular external attack-surface scans of your suppliers' internet-facing assets - because a supplier's posture changes between questionnaires.

    Powered by the CISOteria Supply Chain Module

    The program runs on the CISOteria Supply Chain module - your supplier risk data stays current, visible, and audit-ready year-round:

    Master supplier register & tiering
    Questionnaire distribution & tracking
    Response scoring & evidence vault
    Requirement packs per risk tier
    External scan findings per supplier
    Expiry & certification alerts
    Supplier risk heatmap & dashboards
    Integration with your main risk register

    What Makes Our Supplier Risk Program Different

    Most supplier risk tools give you software and leave you the work. We run the program - and the CISOteria platform keeps it alive between cycles.

    Managed, Not Just Tooled

    IPV analysts run the mapping, questionnaires, validation, and follow-ups. You get outcomes and a dashboard - not another system to operate.

    Risk-Proportionate Depth

    Critical suppliers get deep-dive assessments and evidence review; low-risk suppliers get lightweight registration - effort goes where risk is.

    Validated Responses, Not Collected PDFs

    Every questionnaire response is scored, challenged, and backed by evidence requests. Non-responders are escalated by a defined protocol.

    Continuous External Scanning

    We scan your suppliers' external interfaces on a regular cadence, so a new exposure at a supplier shows up in your dashboard - not in the news.

    Hebrew + English Supplier Engagement

    Questionnaires and requirement packs in the supplier's language. Hebrew outreach gets dramatically higher response rates from Israeli vendors.

    Regulatory Evidence Built In

    The program produces the supplier-risk evidence NIS2, ISO 27001 (A.5.19–5.22), BoI 361, the Privacy Law, and cyber insurers ask for.

    How the Engagement Works

    Every engagement follows a structured delivery model - anchored in the IPV methodology (GOVERN · ASSESS · PROTECT · COMPLY · RESPOND) and ensuring clarity, accountability, and measurable outcomes at each stage.

    01

    Kickoff & Governance

    Supplier security policy, risk appetite, and RACI
    CISOteria Supply Chain module configured for your organization
    02

    Mapping & Categorization

    Full supplier discovery into the Master Supplier Register
    Four-tier risk classification of every supplier
    03

    Assessment Waves

    Tiered questionnaires distributed, chased, and collected
    Responses scored, validated, and backed by evidence
    04

    Requirements & Remediation

    Each supplier directed to its tier's cyber requirements
    Gaps tracked as remediation items with owners and dates
    05

    Monitoring & Reporting

    Continuous external interface scanning and expiry alerts
    Executive dashboard, quarterly reviews, and audit-ready evidence

    What You Receive

    Tangible, actionable outputs designed for both technical teams and executive leadership.

    Master Supplier Register

    Every supplier mapped, categorized, and maintained in CISOteria.

    Risk Tiering & Heatmap

    Four-tier classification with a live supplier risk heatmap.

    Validated Assessment Reports

    Scored questionnaires, evidence review, and per-supplier scorecards.

    Supplier Requirements Packs

    Tier-matched cyber requirements and contract security clauses.

    External Scan Findings

    Recurring attack-surface scan reports for supplier internet-facing assets.

    Executive & Regulatory Reporting

    Monthly summaries, board dashboards, and an audit-ready evidence package.

    Three Service Tiers. One Managed Program.

    Start where you are - build the program once, or hand it to us as an ongoing managed service. Pricing depends on the number of suppliers and your regulatory scope.

    // 01

    Supplier Risk Foundation

    Scope: A 4–6 week project that stands up your program: policy, full supplier mapping, risk categorization, and tiering of your top 30 suppliers - configured in CISOteria.

    What you get

    Supplier security policy and governance (RACI). Master Supplier Register with four-tier classification. CISOteria Supply Chain module setup and executive readout.

    Scope boundary

    Program build and tiering - full questionnaire waves and deep assessments of critical suppliers are delivered in the Full Program tier.

    $10,000 – $16,000
    Most Popular
    // 02

    Supplier Risk Full Program

    Scope: An 8–12 week program: everything in Foundation, plus questionnaire waves, validated assessments of 10–20 critical suppliers, contract security requirements, and a regulatory evidence package.

    What you get

    Tiered questionnaires sent, validated, and scored by IPV. Supplier requirement packs and remediation tracking. Evidence package for NIS2 / ISO 27001 / BoI 361 / Privacy Law audits.

    Scope boundary

    One-time program delivery - ongoing monitoring, new supplier onboarding, and recurring scans are delivered in the managed service.

    $18,000 – $35,000
    // 03

    Supplier Risk Management as a Service

    Scope: The full program as an ongoing managed service: IPV owns supplier risk end-to-end - assessments, questionnaire cycles, requirement enforcement, external scanning, and reporting - on the CISOteria Supply Chain module.

    What you get

    Quarterly reassessment of critical suppliers; new suppliers onboarded within 10 business days. Regular external attack-surface scans of supplier interfaces. Monthly executive reporting and always-current regulatory evidence.

    Scope boundary

    Managing your suppliers' risk - remediation work inside the supplier's environment is executed by the supplier, tracked by us.

    $3,500 – $6,500 / month

    Pricing is indicative and depends on the number of suppliers and regulatory scope. Final pricing is confirmed after a complimentary scoping call. CISO-as-a-Service clients can add supplier risk management as a program booster at reduced cost.

    We tell you exactly what you get. And what you don't.

    ✅ Included
    • Full supplier mapping and categorization
    • Questionnaires managed end-to-end by IPV
    • Response validation with evidence review
    • Tier-matched cyber requirement packs
    • Recurring external interface scanning
    ❌ What Supplier Risk Management Does Not Include
    • Remediation execution inside supplier environments (suppliers implement; we direct and track)
    • Full penetration testing of suppliers (external surface scanning only; PT available as a separate engagement with supplier consent)
    • Legal drafting of supplier contracts (we provide the security clauses; your counsel drafts)
    • Deep fourth-party audits (sub-supplier risks are identified and flagged, not audited)
    • Live incident response at a breached supplier (coordinated via IRT-as-a-Service)

    Why we publish this: scope ambiguity costs organizations money and trust. Every vendor should publish what a program includes and excludes. If yours won't - ask why.

    Related Guides

    Want to go deeper before we talk? Start with our in-depth guides:

    Supplier Risk Management: Complete Guide Compliance Guide: ISO 27001, NIS2 & DORA

    Start the Conversation

    Ready to map and secure your supplier ecosystem? Speak with our supplier risk team today.

    Start a conversation