Insights · Field note · Security assurance and compliance
Third-party risk reviews for small suppliers
The supplier with four staff and standing access to your systems is a bigger risk than the enterprise vendor with a SOC 2 report. Review them in proportion.
Small suppliers are often the most consequential third parties and the least reviewed: the bookkeeper with accounting access, the IT contractor with administrator credentials, the marketing agency with the website login, the integrator with a remote connection to the plant. They rarely have certifications, cannot complete a three-hundred-question form and would not be honest if they did. Reviewing them well means focusing on what they can reach, how they reach it, what controls apply to that access, and what evidence they can actually produce, with the organization fixing on its own side what the supplier cannot.
In detail
What the evidence shows.
Why small suppliers matter more
An enterprise vendor with a SOC 2 report has controls, a security team and an incident process. A four-person supplier with standing administrator access has a laptop, a shared password and no plan. Attackers know which is easier. In our reviews (first-hand) the supplier access that worries us most is almost always the small, trusted, long-standing one that nobody has looked at in years.
What to ask
What do you access, from where, with what accounts. Is multi-factor authentication enforced on those accounts. Who else at your firm can use them. Are devices managed and encrypted. What happens when a staff member leaves. Have you had an incident. A dozen specific questions, answered honestly, beat a questionnaire the supplier cannot understand.
What to fix on your side
Give the supplier a named account, not a shared one. Enforce MFA on it. Limit it to what the work requires. Log its use. Review it quarterly and remove it when the engagement ends. Most of the risk from small suppliers is controlled by the organization’s own access governance, which does not depend on the supplier improving.
Record it
A register entry with access, conditions, review date and the supplier’s answers. Conditions in the engagement terms. The register is what a customer, auditor or insurer asks for. See third-party risk reviews, vendor security assessments that do not waste everyone’s time and the glossary entry for third-party risk.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days