Suppliers
Last checked on
Suppliers records who delivers what to your organisation, how critical they are, who owns the relationship, whether they process personal data and when you last reviewed them. You can also send them a questionnaire.
Why this protects your organisation
Your hosting provider, your email service and your support tool all handle data you are responsible for. If one of them has a breach, your customers will ask you what you knew and what you checked. Keeping track of your suppliers, and reviewing the important ones regularly, lets you answer that question. ISO 27001 covers this in the supplier controls of Annex A, starting at control 5.19.
Steps
- Open Suppliers in the Organisation group.
- Click New Supplier.
- Fill in the Name and What they deliver, and choose the Status and Criticality. Both are required.
- Choose an Owner and switch on Processes personal data if it applies.
- Under Review, fill in Last reviewed, Next review and the Outcome, then click Create.
- Choose Set up supplier tasks in the supplier's row to create the follow-up tasks for a new supplier.
- When you stop working with a supplier, choose Retire, enter the Retirement date and click Submit.
The list shows each supplier's Name, Status, Criticality, Owner, whether it Processes personal data and the Next review date. A review that is late is marked with the date it was due; one without a date shows Not planned. You can filter on Status and Criticality.
The fields
- What they deliver What this supplier does for you, in your own words. For example: hosts our production database.
- Status Active, Inactive or Offboarded.
- Criticality Low, Medium, High or Critical. A supplier you cannot do without for a day is usually High or Critical.
- Owner The person who manages the relationship and makes sure the review happens.
- Review When you last looked at the supplier, what came out of it, and when you plan to look again.
Questionnaires
On a supplier's page, Invite for a questionnaire sends a questionnaire to a contact at the supplier. You choose the Questionnaire, the Contact name and Contact email address, the language, an optional Answer before date and a Personal message. The contact receives a link by email and answers with a free supplier account. Once submitted, you read the answers under Answers and can Mark as reviewed. The answers become evidence with the status under review; you decide whether they count. Send again sends a new link and Revoke stops the link working.
Tasks
The Tasks section on a supplier's page shows the linked tasks. Set up supplier tasks creates the tasks from the task templates, such as assessing the supplier and recording the data processing agreement.
If it does not work
The Next review column says Overdue since
The planned review date has passed. Review the supplier, then fill in the new Last reviewed date, the Outcome and a new Next review date.
I cannot invite a supplier for a questionnaire
Retired suppliers cannot be invited. Otherwise you need edit rights for the Organisation module; an advisor only has them when the workspace owner has granted them.
A supplier I retired is still in the list
That is intended. A retired supplier gets the status Offboarded and stays visible, so your history remains complete. Filter on the Status Active to see only current suppliers.
I do not see New Supplier
Adding a supplier requires edit rights for the Organisation module. Only owners and members can delete a supplier.
Screens this is about
- Suppliers