Third Party Risk for Small Organisations

Most supplier risk guidance assumes a dedicated team, a risk platform and hundreds of assessments a year, so small organisations either copy a process they cannot sustain or do nothing at all. The UK government's Cyber Security Breaches Survey 2025/2026 found that only 15% of businesses had reviewed the risks posed by their immediate suppliers, and 6% had looked at their wider supply chain, with the immediate supplier figure at 12% for micro businesses. Yet a small firm usually depends on a handful of suppliers for almost everything: email, accounting, payroll, the website, the IT provider and the payment processor. This guide gives organisations of roughly 5 to 250 people a supplier check process that one person can run in a few hours a quarter, without a platform or a 300-question questionnaire. It is written for owners, office and operations managers, and the IT lead or outsourced provider who supports them. The full programme view is in the Third-Party Risk Management Guide; this page is the small organisation version and does not repeat it.

Key takeaways

Start with a list, not a questionnaire. A one-page supplier register built from bank statements, card payments and sign-in data finds the suppliers that matter faster than any assessment.
Sort suppliers into three groups. Spend real effort only on the few that hold your customer data, run a critical service or can log in to your systems.
Reuse evidence that already exists. A Cyber Essentials certificate, an ISO/IEC 27001 certificate with the right scope, a SOC 2 report or a CSA STAR listing answers most questions you would ask.
The settings you control matter as much as the supplier. Multi-factor authentication, admin accounts, OAuth app approvals and data exports on your side of each service close most of the risk.
Offboarding is part of the process. Removing access, keys and data when a supplier leaves is the step small organisations skip most often.

Why the usual TPRM process does not fit

Programme-style third-party risk management rests on dedicated staff, a governance committee, inherent risk scoring models, platform workflows and contract leverage. A 20-person firm has none of these, and most of its suppliers are large SaaS providers that will not answer a custom questionnaire or negotiate security terms. Trying anyway produces three predictable results: a questionnaire nobody returns, a spreadsheet nobody updates after the first month, and false comfort that the job is done.

The small organisation version keeps the same purpose, knowing which suppliers could hurt you and doing something proportionate about each, but changes the method:

Programme TPRM	Small organisation version
Risk platform with workflows	One spreadsheet or shared table with eight columns
Inherent risk questionnaire with weighted scoring	Four yes or no questions that place a supplier in group A, B or C
Custom security questionnaire to every supplier	Public evidence check for SaaS providers; a short question set only for small local suppliers with access
Negotiated security schedule	Read the standard terms and data processing agreement; negotiate only with local providers such as your IT support firm
Continuous monitoring feeds	Quarterly 30-minute review plus supplier breach notifications to a shared mailbox
Board reporting	A short note to the owner or directors once a year

This is consistent with NIST SP 1305, the CSF 2.0 quick-start guide for supply chain risk management, which applies the GV.SC category in a way scaled to the organisation, and with the four stages of the NCSC supply chain security guidance: understand the risks, establish control, check your arrangements and improve continuously.

Step 1: build the supplier register in an afternoon

Small organisations rarely have a procurement process, so suppliers arrive through a card payment, a free trial or a staff member clicking "Sign in with Google". Find them from four sources rather than from memory.

Payments: export 12 months of bank and card transactions and list every recurring payee. This finds paid SaaS, hosting, domain registrars and the IT provider.
Sign-ins and app grants: in Microsoft 365, review Enterprise applications in Entra ID; in Google Workspace, review the third-party app access list under Security, API controls. These show free apps staff have connected with company accounts. The How to Inventory third party oauth apps in google workspace guide walks through the Google view.
DNS and website: your DNS records (MX, SPF includes, CNAMEs) name your email provider, mailing tools and website host, and the website's plugins and embedded scripts name more.
People: ask each team lead one question: "Which outside services would stop your work if they disappeared tomorrow?"

Record each supplier with only the fields you will use:

Column	Example	Why it matters
Supplier and service	Payroll SaaS	What you are actually relying on
Internal owner	Finance manager	Someone who answers for it and notices changes
Data held	Staff bank details, salaries, NI numbers	Drives the group and any data protection duties
Access into your systems	None, or "remote admin to all laptops"	Suppliers with access are the highest risk
Business impact if unavailable for a week	Cannot pay staff	Drives continuity planning
Group (A, B, C)	A	Sets how much checking to do
Evidence held and expiry	ISO/IEC 27001 certificate, expires 2027-03	Tells you when to look again
Next review date	2027-02	Keeps the register alive

Step 2: sort suppliers into three groups

Ask four questions about each supplier. Any "yes" to questions 1 to 3 puts it in group A.

Does it hold or process personal data about customers or staff, or your confidential business data?
Can it log in to, manage or push software to your systems (remote support tools, managed IT, website admin, payment integrations)?
Would losing it for a week stop you trading, paying people or meeting a legal duty?
Does it handle money on your behalf (payments, invoicing, payroll)? A "yes" with no other "yes" makes it group B at least, and group A if it can change payee details.

Group	Typical members	Checks	Review
A: critical	Email and file platform, IT support provider or MSP, accounting and payroll, payment processor, customer database or CRM, website host if it takes orders	Evidence check, your-side settings review, contract and data processing terms, exit plan	Yearly, and on any incident or major change
B: important	Marketing email tool, scheduling, e-signature, HR tool with limited data, backup service	Evidence check and your-side settings review	Every two years, or at renewal
C: low	Stationery, office cleaning with no system access, free tools with no company data	Record it; confirm no company account or data is used	When the register is reviewed

Most small organisations end up with 5 to 15 group A suppliers. If you have more than 20, the questions are being answered too cautiously; if you have fewer than three, the payment and sign-in sources were probably missed.

Step 3: check what each group A supplier can prove

Large providers will not fill in your questionnaire, but most publish assurance material on a trust or security page. Check it in this order and stop when you have enough.

Evidence	What it tells you	How to check it	Watch for
Cyber Essentials or Cyber Essentials Plus	The UK baseline of five controls: firewalls, secure configuration, security update management, user access control and malware protection. Plus adds independent technical testing	Search the certificate on the IASME certificate search, the NCSC delivery partner	Certificate expired or issued to a different legal entity
ISO/IEC 27001 certificate	An information security management system was audited by a certification body	Ask for the certificate and the scope statement	Scope that covers head office but not the service you buy
SOC 2 Type 2 report	Controls were tested by an independent auditor over a period	Request it under NDA; read the exceptions and the complementary user entity controls	Report older than 12 months with no bridge letter; controls you are expected to run yourself
CSA STAR Registry listing	Level 1 is a published CAIQ self-assessment; Level 2 adds third-party attestation or certification	Search the provider on the CSA STAR Registry and check the listing status	Status shown as expired or deprecated
Data processing agreement	How the supplier handles personal data, sub-processors and deletion	Usually published with the terms of service	No list of sub-processors or no breach notification commitment
Security page and status history	Incident communication, MFA and SSO options, data location	Read the provider's security and status pages	No way to subscribe to incident or status notices

The How to Read a SOC 2 Report Guide explains which sections to read in under an hour. For the difference between the two most common certificates, see Cyber Essentials vs ISO 27001.

Small local suppliers with access

Your IT support firm, bookkeeper or web developer is often a business smaller than yours with privileged access to everything. These are the suppliers where a short set of direct questions is worth sending, because they will answer and the answers change your risk. Ask no more than ten:

Do you hold Cyber Essentials or Cyber Essentials Plus? Please send the certificate number.
Does every one of your staff use multi-factor authentication on the tools that reach our systems, including your remote management tool?
Do your staff use individual named accounts in our systems, never a shared login?
Which remote access or management tools do you use with us, and how is access to them controlled?
Where do you store our passwords and keys, and who can see them?
Do you subcontract any of the work for us? To whom?
How quickly will you tell us if you suffer a security incident that could affect us?
Do you hold backups of our data, where, and have you tested a restore in the last year?
Do you have cyber insurance?
When we stop working together, how will you return our data and remove your access?

For managed IT providers specifically, the Choosing an IT Support Provider or MSP Securely guide and the MSP Security Questionnaire Template go deeper.

Step 4: secure your side of each service

With large SaaS providers, the biggest risks a small organisation can actually reduce sit in its own tenant. A supplier with excellent certifications still cannot stop an attacker who logs in with a reused staff password. For each group A service, check five things and record the result in the register:

Multi-factor authentication: on for every user, and enforced rather than optional. Prefer phishing-resistant methods such as passkeys for admin accounts.
Admin accounts: at least two named admins so you are never locked out, no more than needed, and none belonging to people who have left. Check whether the supplier's own staff hold admin access to your tenant, and remove it if they do not need it.
Connected apps and API keys: review third-party apps granted access to email, files or the CRM; restrict who may approve new apps; revoke keys for integrations that are no longer used. The Consent Phishing and Illicit OAuth Grants Guide covers why this matters.
Single sign-on: where the plan allows, sign in through Microsoft 365 or Google Workspace so leaver accounts are disabled in one place.
Your own copy: confirm you can export your data in a usable format and, for group A services, keep a recent export or backup outside the supplier.

The Small Business Identity and Access Security Guide covers these settings across common platforms.

Step 5: contract terms worth checking

You will not renegotiate a large provider's terms, but you should read the parts that matter before you sign and know what you have agreed to. Where you can negotiate, usually with local IT, development and bookkeeping firms, ask for the terms below.

Personal data: under UK GDPR Article 28(3), as summarised by the ICO, a contract with a processor must cover processing only on your documented instructions, confidentiality of staff, the security measures required by Article 32, prior written authorisation for sub-processors, help with individuals' rights and breach notification, deletion or return of data at the end of the contract, and the information and audit rights you need to demonstrate compliance. Most SaaS providers publish a data processing agreement that covers these; check that one exists and is part of your agreement. If you need to ask a processor directly, the Data Processor Due Diligence Questionnaire Template helps.

For suppliers you can negotiate with: named accounts and MFA for their staff, notice of security incidents affecting you within an agreed number of hours, no subcontracting without telling you, return and deletion of data at exit, and removal of all access on termination. The Third-Party Security Contract Clauses Template has wording you can trim to two or three clauses.

Step 6: keep it running with a quarterly half hour

Quarterly, 30 minutes: re-run the payments and connected apps review, add new suppliers, mark any that have gone, and check that group A evidence has not expired.
Yearly, two to four hours: repeat steps 3 to 5 for group A, refresh the local supplier answers, and write the short note to the owner or directors.
On a supplier incident: when a supplier notifies you of a breach, or one appears in the news, check the register for what data and access it holds, rotate any passwords and keys it held, review sign-in logs for its accounts, and decide whether customers must be told. The Small Business Incident Response Guide covers notification decisions.
On change: treat a supplier acquisition, a new data location or a move to a new subcontractor as a trigger to look again.

Route supplier security and status notices to a shared mailbox rather than one person's inbox, so they are still seen when that person is away.

Step 7: offboard suppliers properly

NIST CSF 2.0 GV.SC-10 calls for supply chain plans to include activities after a relationship ends, and this is where small organisations most often leave risk behind. When a supplier leaves, especially an IT provider or developer:

Disable their named accounts and any shared accounts they knew, and change passwords they held.
Remove their remote management agent from every device and revoke its tenant-level permissions.
Revoke API keys, app registrations and OAuth grants they created.
Transfer domain registrar, DNS and hosting accounts into your own name if they were registered by the supplier.
Obtain your data and written confirmation that their copies are deleted.

Domain and DNS ownership deserves its own mention: a web developer who registered your domain in their name controls your email and website. See the NHI Offboarding and Decommissioning Guide for the machine credentials side.

Small versus growing organisations

Under about 20 people: the register, the three groups and your-side settings are enough. The owner or office manager runs it, with the IT provider checking tenant settings.
About 20 to 100 people: add the yearly evidence check and the local supplier questions, name an owner per group A supplier, and add a short supplier section to your security policy. The Supplier Security Policy Template can be cut down to a page.
About 100 to 250 people, or selling to large customers: your own customers will start sending you their questionnaires. Hold Cyber Essentials, keep the register current and evidence-backed, and consider the Vendor Security Assessment Template for new group A suppliers. A dedicated platform is still unlikely to pay off at this size.
Regulated work: if you supply financial services, healthcare or the public sector, contract terms may impose specific supplier controls on you; follow those, as they override this lightweight process.

Measuring whether it is working

Measure	Target	How to count it
Recurring payees and connected apps found in the register	100% of those seen in the quarterly review	Compare the quarter's payment export and app list against the register
Group A suppliers with current evidence	All	Evidence expiry dates in the register
Group A services with MFA enforced for every user	All	Tenant admin settings per service
Supplier accounts or apps found active after the supplier left	Zero	Quarterly review of accounts and connected apps
Quarterly reviews completed on time	Four a year	Date stamp in the register

Framework mapping

Step	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ISO/IEC 27001:2022 Annex A
Register and grouping	GV.SC-04	SR-3	5.19 Information security in supplier relationships
Evidence check before purchase	GV.SC-06	SR-6	5.19, 5.20 Addressing information security within supplier agreements
Your-side settings and ongoing review	GV.SC-07	SA-9	5.22 Monitoring, review and change management of supplier services; 5.23 Information security for use of cloud services
Offboarding	GV.SC-10	SA-9	5.22

For UK organisations, Cyber Essentials does not assess supplier management directly, but holding it yourself answers the first question your own customers will ask. See the Cyber Essentials Guide.

Common failure patterns

Sending large SaaS providers a custom questionnaire: it is ignored or answered with a link to the trust page. Read the trust page first.
Accepting a certificate without reading its scope: an ISO/IEC 27001 certificate that covers the supplier's office IT says nothing about the product you buy.
Ignoring free apps: a free note-taking or file conversion app connected to company email can read more data than a paid supplier. The Shadow SaaS and Unsanctioned App Discovery Guide covers how to find them.
Trusting the IT provider without checking it: the managed IT firm usually holds the most access of any supplier, yet is the one least likely to be asked about MFA or its remote tools.
Letting the register die after month one: without a calendar entry and an owner, the register is out of date within a quarter.
No exit: a developer who still holds the domain registration, or an old remote support agent still on laptops, is a supplier relationship that never ended. The Top 10 Third-Party Risk Mistakes lists more.

Practitioner checklist

Build the register from 12 months of payments, connected apps, DNS records and a question to each team lead.
Place each supplier in group A, B or C using the four questions.
For each group A supplier, record the evidence held, its scope and its expiry date.
Send the ten questions to local suppliers with access to your systems, starting with the IT provider.
Enforce MFA, review admin accounts and connected apps, and confirm data export for every group A service.
Confirm a data processing agreement is in place for every supplier holding personal data.
Route supplier security and status notices to a shared mailbox.
Book the quarterly 30-minute review and the yearly group A review in the calendar.
Offboard leaving suppliers with the five-step list, including domain and DNS ownership.
Escalate to a fuller process, such as a Supplier Security Audit Guide approach, only for a supplier whose risk cannot be settled with evidence and settings.

Third Party Risk for Small Organisations: A Lightweight Supplier Check Process