You map suppliers and service providers, such as an IT partner, a data centre or a cloud provider, as assets in Varmo. In the supplier register, you record what the supplier provides, whether it is outsourcing, which contracts exist and how you have assessed the supplier (ISO/IEC 27001, Annex A 5.19 to 5.22). Beyond that, the same processes apply as for your systems: owner, dependencies, inherited protection requirement and the baseline check. This guide is aimed at ISMS managers and everyone responsible for service providers.

Before you start

  • Suppliers are assets of a top-level category with the Type “Suppliers (service providers)”. Every organisation starts with the top-level category Suppliers containing the category Service provider at the “Rooms, buildings and service providers” level of the dependency chain. You adjust the structure and type under ISMS settings › Assets › Asset structure, see Adjusting the asset structure.
  • Details, contracts and assessments are maintained by anyone who may edit the asset: all assets, or their own as owner. Anyone who may view the asset can see them. The register is included in all plans.
  1. OwnerAdd details

    Service, contact, country, personal data, outsourcing.

  2. OwnerAdd contracts

    Term, notice period, renewal.

  3. OwnerAssess

    Questionnaire and overall verdict with justification.

  4. Reassess

    After the interval, 12 months by default.

Notice period is ending

30 days before the last cancellation date, a task reminds you of the decision.

A supplier in the register

A supplier is an asset of the Suppliers type. First, the owner records the details of the service, contact and outsourcing, then the contracts with term and notice period. Next, the owner assesses the supplier with the questionnaire and records an overall verdict. The review interval determines the next assessment; the owner receives a task 30 days beforehand and 30 days before the last cancellation date of a contract.

How to record a supplier

  1. Create the supplier in the inventory like any other asset and choose a category of the “Suppliers” type, such as Service provider, see Recording assets and defining dependencies. Set the Owner, i.e. the person responsible for the relationship.
  2. On the asset page, open the Supplier tab and click Add details: service, contact person and email, country of the service or of the data, whether the supplier processes personal data on your behalf and whether a data processing agreement is in place, the Outsourcing and the Exit strategy. Under Review every (months), you define how often you assess the supplier (12 by default).
  3. Use Add contract to record the contracts: title, start, end, notice period in months or days and whether it renews automatically. Optionally, you link the contract to a document from Documents & evidence.
  4. Click Add assessment, answer the ten questions with Yes, Partially, No or Not applicable and choose the Overall verdict: Suitable, Suitable with conditions or Not suitable. Varmo suggests a likely verdict; you decide and justify it yourself. With Record assessment, it is saved; it can no longer be changed afterwards, and a new assessment supplements it.
  5. Under Linked assets, link the applications or systems the supplier operates or the information it processes, and carry out the baseline check.

The register

Under Assets › Suppliers, you see all suppliers you have access to, with owner, criticality, outsourcing, latest verdict, next review and next cancellation date. Use the filters Assessment due, Outsourcing and Notice soon to narrow down the list. If details are missing, the supplier shows “Details missing”.

Sharing risks with suppliers

If you choose the treatment option Share for a risk, for example because a service provider takes over operations, Varmo additionally suggests the supplier relationship requirements from ISO/IEC 27001 Annex A (A.5.19 to A.5.23) for the measures, provided your organisation has adopted this catalogue. See Reporting, reviewing and treating risks.

What happens next

  • The owner receives the task Assess supplier as long as there is no assessment, and Reassess supplier 30 days before the next review. If the supplier has no owner, the task goes to the people who may edit all assets.
  • 30 days before the last cancellation date of a contract, the owner receives the task Notice period is ending. The date is the end minus the notice period; if a contract is renewed, enter the new end date.
  • If the protection requirement of linked information changes, Varmo adjusts the criticality of the supplier.

Frequently asked questions

Where do I store the contract itself?

Upload it under Documents & evidence and link it to the contract in the Supplier tab. You store evidence for individual requirements in the baseline check.

Can I correct an assessment?

No, assessments remain unchanged as evidence. Record a new assessment; the latest one applies to the next review.

Are suppliers also interested parties?

Yes, if they have requirements of your information security. You record interested parties in the context of the organisation, independently of the assets.