Fee
Register to see indicative feesConfirmed in writing after scoping01 / Build & Advisory · Standard
GRC & Third-Party Risk
Your suppliers hold your data and your uptime, and the assurance you have over them is a questionnaire nobody reads.
Assurance & ComplianceBuild and advisory
Typical duration
8 to 14 weeksDepends on supplier count and tiering complexityPrimary artefact
Supplier risk framework and an assessed vendor registerPlus two moreWho leads it
Steve SharmaFounder & Principal04 / What this is
What GRC & Third-Party Risk is
A framework and assessment engagement covering third-party risk: how suppliers are tiered, what assurance each tier requires, and what your current material suppliers actually look like when assessed.
And what this service produces
It produces a working process and a populated register, not a policy describing one.
05 / Who it is for
Built for a real assurance trigger, not a badge project.
01
This fits when
- You have material supplier dependencies and no tiering.
- Supplier questionnaires are collected and not read.
- You are a regulated entity with third-party obligations.
- You are preparing for an audit with supply chain scope.
02
The usual trigger
- A regulator or auditor has asked about third-party risk.
- A supplier incident affected you.
- A customer has asked how you assure your own supply chain.
- Supplier questionnaires exist but nothing happens with them.
06 / The obligation
Why supplier questionnaires produce paperwork rather than assurance
Most third-party risk programmes collect the same questionnaire from every supplier, score none of them consistently, and act on almost none of the answers. The result is a compliance artefact, not an assurance one.
A uniform process fits no supplier
The failure is structural: a uniform process applied to a supplier who cleans the office and a supplier who hosts your customer database cannot be proportionate to either.
Effort lands in the wrong place
The first is over-assessed and the second under-assessed, and the effort spread across both leaves nothing for the one that matters.
Tier, assess proportionately, accept evidence
The programmes that work tier first, assess proportionately, and accept existing evidence, such as a current ISO 27001 certificate or SOC 2 report, rather than asking a supplier to complete a bespoke questionnaire they will answer optimistically.
Tier first, then assess proportionately. A uniform questionnaire is effort spread evenly across suppliers whose risks are not evenly distributed.
07 / What you receive
Three artefacts. Each one yours to keep.
- 01
Supplier risk framework
Tiering criteria, assurance requirements per tier, and the process that applies them.
Framework documentProcurement and risk - 02
Assessed vendor register
Your material suppliers, tiered and assessed, with gaps and actions.
RegisterRisk owner - 03
Contract and onboarding requirements
The security clauses and evidence requirements that attach at procurement.
Requirement setProcurement and legal
08 / Scope
The whole system is visible before work begins.
Tiering
- Tiering criteria defined against actual dependency
- Supplier population tiered
- Material suppliers identified
Assurance design
- Assurance requirements per tier
- Existing evidence accepted where valid
- Assessment cadence
Assessment
- Material suppliers assessed
- Gaps identified and rated
- Remediation or acceptance decisions
Integration
- Procurement onboarding requirements
- Contract security clauses
- Ongoing monitoring triggers
09 / Included / not included
A useful boundary is part of the deliverable.
Included
- Supplier tiering against actual dependency
- Assurance design for each tier
- Assessment of material suppliers
- Integration with procurement and contracts
Not included
- Supplier remediation: We assess and identify. Getting suppliers to fix things is your commercial relationship.
- Continuous supplier monitoring: This is not a managed service.
- Legal drafting: We specify security requirements; your legal team drafts the clauses.
- Assessment of every supplier: We assess material suppliers. The tail is handled by the framework, not by us.
10 / How we do it
A traceable path from scope to evidence.
Tiering
Criteria built against actual dependency, then the population tiered.
Assurance design
Requirements per tier, with existing evidence accepted where valid.
Material supplier assessment
Assessment of the suppliers that actually matter.
Integration and handover
Procurement and contract requirements, with a named owner.
Mapped againstISO/IEC 27001ISO/IEC 27036NIST Cybersecurity FrameworkAPRA CPS 234 (Australia)
11 / Timeline
8 to 14 weeks of work.
Elapsed time and customer effort are separated because they are not the same number.
Weeks 1 to 3
Tiering criteria and population tiering
Build the criteria against actual dependency, then tier the supplier population.
Customer effort
Supplier data access plus three to four interviews.
Weeks 4 to 6
Assurance framework design
Set the requirements per tier, accepting existing evidence where valid.
Customer effort
One half-day workshop with procurement and risk.
Weeks 7 to 11
Material supplier assessment
Assess the suppliers that actually matter. Supplier responsiveness sets the pace here, not our assessment work; engagements that slip almost always slip waiting on a third party.
Customer effort
Supplier introductions and follow-up, the usual cause of delay.
Weeks 12 to 14
Integration, contracts, handover
Attach the procurement and contract requirements and hand over to a named owner.
Customer effort
One session with procurement and legal.
Our work: 8 to 14 weeks
12 / Scope check
Test whether GRC & Third-Party Risk
is the right next move.
We will cover likely scope, cost and fit.
Book a confidential strategy sessionWith Steve Sharma, who would lead.13 / Who leads the engagement
Named lead. Direct assessment.
Your third-party risk engagement lead
Steve Sharma
Founder & Principal
Designs the framework and assesses the material suppliers personally.
ASD-endorsed IRAP AssessorCISSPCREST
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Review leadership record14 / Why Cybersecurity Link
Three decisions.
Accountability.
Tier first, assess proportionately.
A uniform questionnaire spreads effort evenly across risks that are not evenly distributed. Ours does not.
Existing evidence accepted where valid.
A current ISO 27001 certificate or SOC 2 report is better evidence than a bespoke questionnaire answered optimistically.
Requirements attach at procurement.
A framework that only applies after onboarding is one that never applies to the suppliers already in place.
15 / The boundary
What this engagement does not claim.
Remediation
We assess and design. We do not remediate suppliers.
Getting suppliers to fix things is your commercial relationship.
Operations
We are not a managed security service.
We do not run continuous supplier monitoring.
Legal
We specify requirements. Your legal team drafts.
We set the security requirements; your legal team drafts the contract clauses.
Frameworks
One process, mapped across four references.
The work maps to ISO/IEC 27001, ISO/IEC 27036, the NIST Cybersecurity Framework and, for Australian regulated entities, APRA CPS 234.
What moves the fee
Where tiering must cover a supplier population of several hundred.
Per material supplier assessed beyond ten.
A starting fee confirmed in writing after scopingNumber of material suppliers assessed confirmed after tieringFramework, assessed register and requirement set
18 / How this fits
Where this sits in the wider programme.
19 / When this is not right
Sometimes the best recommendation is a smaller service, or a later date.
20 / FAQ
The questions that change the decision.
No, and a programme that tries to is one that assesses none of them properly. We tier the population and assess the material ones; the tail is handled by the framework.
Yes, where it is current and its scope actually covers what you depend on. A valid ISO 27001 certificate is better evidence than a bespoke questionnaire a supplier answered optimistically.
That is itself a finding, and usually an informative one. We document it and it becomes a commercial decision rather than a security one.
No. We identify and rate; the influence sits with your commercial relationship, not with us. We would rather say that than imply influence we do not have.
21 / Next move
If GRC & Third-Party Risk is what you need, the next step is a conversation about scope.
A 45-minute conversation about what your scope actually looks like, what it would cost, and whether this is the right service for you at all. With Steve Sharma, who would lead the engagement.