Question

A global manufacturer onboards over 400 new suppliers each year, ranging from raw-material shippers to a SaaS provider that will host the company's engineering IP and PII. The GRC team currently applies an identical 200-question security assessment and annual audit to every supplier, causing months-long onboarding delays and analyst burnout. Leadership asks the security director to make third-party risk management more efficient without weakening oversight of critical relationships. Which approach should the director implement first?

Accepted Answer

Establish a vendor tiering model that classifies suppliers by data sensitivity, business criticality, and access level, then scales diligence depth to each tier

Answer

Replace all supplier assessments with a signed self-attestation questionnaire and rely on contractual indemnification clauses

Answer

Continue the uniform 200-question assessment but hire additional contract analysts to reduce the onboarding backlog

Answer

Require every supplier to obtain a SOC 2 Type II report before onboarding regardless of the services they provide