Your supplier passed the assessment. Do you actually know the risk?

A supplier can answer every security question correctly, hold a recognised certification and still represent one of your organisation's most consequential supplier risks.

That is not a failure of questionnaires. It is not a failure of certification either. Both can provide important assurance evidence.

The failure is treating the evidence as if it carries the same meaning in every supplier relationship.

Consider two suppliers with similar assessment results. One provides a low-impact marketing service and processes no sensitive data. The other supports an operationally critical service, has privileged connectivity into your environment and would take months to replace. The same answer, certificate or security score does not create the same risk decision.

That principle is already present in current guidance. The UK National Cyber Security Centre (NCSC) says organisations should understand their supply chain, determine the relative criticality of suppliers, tailor assurance to the relationship, decide what evidence is needed to support supplier responses, and keep that evidence current as the underlying risk changes. NIST SP 1305, the Cybersecurity Framework 2.0 C-SCRM Quick-Start Guide, takes a similar lifecycle approach: establish and operate a cyber supply-chain risk capability, define supplier requirements, and make the robustness of those requirements correspond to supplier criticality.

Questionnaires are not the problem

A well-designed questionnaire does something important: it creates a structured conversation about governance, access control, incident response, data protection, resilience, subcontractors and other areas that are difficult to infer from the outside.

The NCSC publishes supplier-assurance questions for exactly that reason. It also makes an equally important point: the questions are not a box-ticking checklist. The depth of supporting evidence should depend on supplier criticality and the risk the relationship creates for your organisation.

This is where supplier-assurance programmes often become inefficient. Teams focus on getting an assessment completed, then the completed assessment becomes the record of risk. Twelve months later the supplier, the service, the evidence and the threat picture may all have changed - but the "approved" status remains.

Current NCSC guidance explicitly warns that supplier responses and evidence represent a point in time and need to be revisited when the risk profile changes. NIST's C-SCRM guidance similarly treats supplier risk management as a lifecycle capability rather than an onboarding event.

Five questions are more useful than one supplier score

A supplier score can help with prioritisation. The decision becomes defensible when the score sits inside context. Five questions expose whether that context exists.

Certification answers an important question - not every question

Certifications and independent assessments matter. The NCSC's supply-chain principles explicitly recognise assurance mechanisms such as Cyber Essentials Plus, penetration testing, external audit and formal security certification where justified.

But the certificate is evidence about a defined scope. Your risk decision has to answer a different question: what does this supplier mean to us?

An ISO 27001 certificate, for example, can provide useful confidence in an organisation's information-security management system within its certified scope. It does not tell you, by itself, whether the particular service you consume is a single point of failure, whether a new subprocessor has been introduced, whether the evidence you relied on six months ago is still current, or whether an open finding has actually been remediated.

The same is true of externally observable security ratings and threat-monitoring signals. They can reveal changes that a periodic assessment may miss. They are valuable signals - but they cannot see every internal control, contractual dependency or service-specific condition. Good supplier assurance combines sources instead of asking one source to do every job.

The real problem is disconnected assurance

The common failure is not "too many questionnaires". It is a broken chain between the information teams collect and the decisions they need to make.

Supplier details sit in a procurement system. Assessment responses sit in a spreadsheet or questionnaire platform. Certifications are stored in email or document repositories. External ratings live in another tool. Findings are tracked somewhere else. The risk register contains a summary. When a senior stakeholder asks, "Which critical suppliers have evidence that is out of date, unresolved high-risk findings or important fourth-party dependencies?", the answer becomes a manual reconciliation exercise.

That is exactly the gap current NCSC and NIST guidance points towards: understand the supply chain, prioritise by criticality, require proportionate evidence, manage the relationship over time, include suppliers in incident planning and monitor whether the controls and assurance arrangements still work.

This is a more useful definition of continuous supplier assurance. It does not mean continuously sending questionnaires. It means keeping the relationship between context, evidence, risk and action alive for as long as the supplier matters to the organisation.

What this looks like in E2ERisk

E2ERisk Supplier Assurance is designed around that connected lifecycle rather than treating the completed assessment as the end state.

E2ERisk includes the Threat Centre as part of Supplier Assurance, where other vendors charge for outside-in monitoring separately. Continuous external scanning and supplier security scoring add an independent signal alongside supplier-provided assessment evidence: an additional input to the decision, not a replacement for the questionnaire, the evidence or analyst judgement.

The question for security leaders

The maturity test for supplier assurance is not how many suppliers completed an assessment this year.

It is whether, for the suppliers that matter, you can answer a harder set of questions without starting a spreadsheet exercise: What service do we depend on them for? What evidence supports the decision? Is that evidence still current? What changed? What is unresolved? Who owns the action? What sits behind the supplier?

If those answers are connected, questionnaires and certifications become more valuable because they sit inside the context needed to interpret them.

If they are not connected, more evidence can simply create more places to look.

That is the difference between collecting supplier assurance and actually managing supplier risk.