ID.RA-10 Critical supplier assessment: requirements and evidence

What ID.RA-10 critical supplier assessment requires before you sign

ID.RA-10 asks you to assess critical suppliers before you acquire them, measured against your business requirements and your cybersecurity requirements, including the supply chains those suppliers depend on. It is the risk assessment counterpart of GV.SC-06 due diligence: GV.SC-06 sets the expectation that you investigate a supplier before entering the relationship, and ID.RA-10 asks that the resulting assessment be an actual, recorded evaluation of risk tied to what the supplier would touch. NIST publishes one Implementation Example for it, which describes supplier risk assessments against business and applicable cybersecurity requirements, including the supply chain. Read the Subcategory in the CSF 2.0 Core in CSWP 29 before you draft your own wording, because the outcome is stated as a result, not as a method.

The requirement is hard in practice for three reasons. First, questionnaires differ from one procurement team to the next, so two critical suppliers rated against the same service can receive incomparable scores. Second, the assessment rarely reaches fourth parties, such as the hosting provider or subprocessor that a supplier relies on to deliver its service, so a risk that sits two layers down goes unseen. Third, the assessment often happens after the contract is signed, when leverage to change terms is gone. Fixing these starts with a written definition of which suppliers count as critical, a common question set tied to the data and services each supplier will handle, and a rule that no acquisition proceeds until the assessment is approved by a named owner.

NIST does not certify suppliers, assessors or organizations against the CSF, and it has no plans for a conformity assessment program, so no badge or report proves ID.RA-10 is met. Your evidence is your own record: the supplier inventory, the assessment files, the decisions and risk acceptances, and the contract clauses that followed. Because the requirement is outcome-based, an assessor will ask whether your process produces a sound pre-acquisition decision for each critical supplier, not whether you used a particular tool. Before starting, confirm with your internal audit or customer what level of documentation they expect, and decide whether an implementation partner will prepare the assessment workflow while your own team owns the decisions.

Which suppliers and services fall under ID.RA-10 scoping

Scoping decides how many suppliers ID.RA-10 touches and how deep each assessment goes. The cards below cover the criteria for calling a supplier critical, the supplier types that usually qualify, and the scope questions that change the workload most.

Business impact as the first filter

Start with what the business loses if a supplier fails, is breached or is unavailable for a period. Ask which revenue streams, regulated services and customer commitments depend on the supplier, and who would decide to accept that loss. A supplier that can stop a core service is critical even if its contract is small. Record the impact rating and the reasoning, because an assessor will ask how the threshold was set.

Data access as a second filter

Suppliers that store, process or can view regulated or confidential data usually qualify, even when the service looks peripheral. List each data category the supplier touches, the volume, and whether the data is personal, payment, health or intellectual property. Include suppliers that only receive copies, such as analytics or support tools, because a copy still carries exposure.

System connectivity and privileged access

Suppliers with a network path into your environment, an identity federation, an API key or remote administrative access need scrutiny even when they hold little data. Map each connection, its direction, the credentials used and the systems reachable. A remote support tool with administrator rights can be more consequential than a large storage vendor with no inbound access.

Supplier types usually in scope

Most programs include SaaS providers that hold business or customer data, managed service providers and managed security providers with administrative access, cloud hosting and infrastructure providers, hardware and software vendors whose products run in production, and data processors handling personal data for you. Confirm each category against your own filters rather than assuming a type is always in or always out.

Whether sub-processors are assessed

Decide whether ID.RA-10 reaches the supplier's own suppliers. Assessing only the primary supplier is cheaper, but a hosting or analytics sub-processor can carry the data and the risk. Ask each critical supplier for its list of sub-processors and the criteria it uses to choose them. Set a rule for when a sub-processor change triggers a fresh assessment.

Linking the result to the ID.AM inventory

Suppliers and their services should appear in the ID.AM supplier and asset inventory, with a criticality field that drives which assessment depth applies. Without that link, scoping decisions drift and new services appear without review. Confirm that procurement, IT and business owners update the inventory when contracts start, change or end, and that the critical flag is reviewed on a set cycle.

How an assessor tests ID.RA-10 against your records

An assessor first asks whether your organization has a defined way to decide which suppliers are critical and what a supplier assessment must cover before acquisition. ID.RA-10 asks that critical suppliers be assessed against business requirements and applicable cybersecurity requirements, including the supplier's own supply chain. The assessor therefore looks for a written procedure, a criticality method, and a set of requirements that the assessment applies. Nothing in the framework prescribes a questionnaire or a scoring model, so the test is whether your method is documented, approved and actually followed.

Criticality definition: A written rule that names which suppliers are critical, based on data access, service dependency or business impact.
Assessment criteria: Security and business requirements that every critical supplier is measured against, including data protection, incident notification and resilience.
Supply chain coverage: Questions or evidence requests that reach the supplier's subcontractors and key dependencies.
Ownership and approval: A named owner for the procedure and evidence that leadership or the risk function approved it.
Review cycle: Records showing the procedure was reviewed when services, regulations or contracts changed.

Check that the procedure matches what teams actually do, because assessors often compare the written method against a sample of files.

Steps to build a supplier assessment that meets ID.RA-10

This sequence turns ID.RA-10 from a statement of intent into a repeatable gate: requirements are set per supplier tier, critical suppliers are identified from the asset inventory, and each acquisition is assessed and decided before the contract is signed. The result is a documented record that shows the assessment happened, what it found and who accepted the residual risk.

Define requirements for each supplier tier
Start by writing down what a supplier must meet before you buy from them. Business owners state the service levels, data handling and continuity needs, and the security team turns these into cybersecurity requirements that scale with the tier, so a supplier that hosts regulated data faces more questions than one that supplies office software. Legal and procurement review the set. The output is a short, approved requirements catalog per tier, with the owner of each requirement named. Confirm the catalog against your own regulatory obligations, since those set the floor for each tier.
Identify critical suppliers from the asset inventory
Use the asset inventory and data flow maps to find every supplier service that touches systems, data or operations you depend on. Record which business services each supplier supports, what data it holds or processes, and what happens if it fails. Suppliers that are critical to a business service, or that have privileged access to it, are marked for the full assessment. The output is a supplier register with a criticality field that the assessment process reads. Refresh the register when new services are onboarded or when an asset changes its supplier.
Set the pre-acquisition assessment gate
Define the point in procurement where no contract can be signed until the assessment is complete. The gate sits between shortlisting and commitment, and it needs a named approver, usually the risk owner for the business service, with security sign-off for critical suppliers. Document the conditions for an exception and who may grant one. The output is a written procedure and a checkpoint in the procurement workflow. Confirm with your procurement team that the gate applies to renewals and purchases made through business units, because those are common routes around the process.
Run and record the supplier assessment
Send each critical supplier the questionnaire or assessment that matches its tier, and ask for evidence rather than only answers. Questions should cover the supplier's own security program, its hosting and access controls, incident notification, and its own supply chain, including which subcontractors it relies on for the service and how it assesses them. Reviewers compare answers with the requirements catalog and note gaps. Independent reports, such as third-party attestations, can be accepted where they cover the scope of the service. The output is a completed assessment file per supplier, with evidence attached and reviewer findings recorded.
Decide and document risk responses
For each finding, the risk owner chooses to accept, transfer, mitigate or avoid the risk, and records the reason. A mitigation might be a contract clause, a technical restriction or a condition to be met within a set period agreed with the supplier. Where the risk is accepted, the decision needs the approver named in the gate. Track each agreed response in the plan of action or risk register so it can be followed to closure. The output is a signed decision record for each critical supplier, listing the findings, the response and the owner. Confirm that the approver has the authority to accept the level of risk involved.
Feed results into the risk register and contracts
Transfer the open risks from each decision record into the enterprise risk register so they appear beside other cybersecurity risks and are reported to leadership. Turn the security requirements that the supplier agreed to into contract terms, such as notification duties, audit or evidence rights, subcontractor rules and exit support. The output is a register entry for each accepted or mitigated risk and a contract with the agreed security clauses. Check the contract with legal before signature, and make sure the clauses survive renewal.
Reassess when the supplier or service changes
Set triggers that send a supplier back through assessment, such as a change in service scope, a new subcontractor, a material incident at the supplier, or the end of an accepted-risk period. Review the full register on the cycle your governance sets. The output is an updated assessment record and a log of triggers, which shows that the supplier view stays current after acquisition. Confirm the review frequency for each tier with your risk owners, because the frequency is an internal decision and not set by the CSF.

Evidence that shows a supplier was assessed before acquisition

An assessor testing ID.RA-10 wants to see that a critical supplier was assessed before the contract was signed, not reconstructed afterward. The artifacts below connect the decision to the purchase and show how the record stays current between audits.

Critical supplier register

A register listing every supplier classified as critical, with the business service it supports, the data it handles, its supply chain dependencies and the named owner. The classification method should be written down so an assessor can see why a supplier is or is not critical. Check that the register matches the asset inventory and the contracts actually in force, since gaps between these lists are a common finding. Confirm the register records the date each supplier was last assessed.

Documented supplier requirements

Written business and cybersecurity requirements that a supplier must meet before acquisition, set by risk tier. These are the yardstick the assessment is measured against, so they must exist before the assessment starts. Requirements should cover access control, incident notification, data location and subcontracting. Check that the requirements are approved, versioned and dated, and that the version used for each supplier is identifiable.

Completed and dated assessment records

For each critical supplier, a completed assessment that records who assessed it, when, which requirements were tested and what the findings were. Dated records placed before the purchase approval are the strongest proof of sequence. Assessments that carry only a signature date added after signing weaken the case. Keep the questionnaire responses, the reviewer's notes and the open findings together so the assessment can be reconstructed.

Supplier security documentation reviewed

Evidence the assessor reviewed, such as the supplier's independent audit report, certifications, penetration test summary, security policies and the list of its own critical subcontractors. The record should state which documents were read, the period they cover and any scope limits. Reviewing a document without noting its scope does not show that the risk was understood. Confirm that the documents are current and that the supplier's own supply chain was considered, which is the part of ID.RA-10 most often missed.

Risk acceptance decisions

Where an assessment finds gaps, a signed record showing that an accountable owner accepted the residual risk, transferred it or required remediation before go-live. Each decision should name the open finding, the compensating control and an expiry or review date. Acceptance decisions made by a team without authority over the risk are a frequent gap. Check that exceptions are tracked in the same risk register used for other risk responses.

Approval records tied to the purchase

The procurement approval, contract signature or purchase order that cites the completed assessment and carries its date. This link is what shows the assessment informed the acquisition decision rather than following it. Confirm that the approval workflow blocks onboarding of a critical supplier without a passing assessment, or records an exception with an owner. Keep the approval reference in the supplier register so the chain can be followed in one place.

What meeting ID.RA-10 costs in money and effort

This table lists the cost components of assessing critical suppliers before acquisition, who is paid for each, whether it is one-time or recurring, and what moves it up or down. Use it to structure a quote request and to see where a self-hosted GRC tool changes the spend. No figures are given because none were supplied for this topic; ask for them in writing.

Cost component	Who is paid or who bears it	One-time or recurring	What drives it up or down
Tooling or GRC licenses	Software vendor, or the organization's own infrastructure team if self-hosted	Recurring license fees, or one-time setup for self-hosted deployment	Number of suppliers tracked and users needing access; a self-hosted tool can remove per-seat license spend but adds hosting and upkeep
Procurement and security staff time	Internal staff, or an implementation partner if scoped in writing	Recurring, per assessment and per renewal cycle	Supplier criticality, depth of questionnaire, and how many suppliers already have reusable evidence
Legal review of contract clauses	Internal counsel or outside counsel	One-time for template clauses, recurring for each new or renewed supplier contract	Standard clause library, negotiation load, and whether suppliers accept the organization's security schedule
External assessments or questionnaire services	Third-party assessment providers or shared-assessment services	Recurring per supplier, often tied to renewal or material change	Whether suppliers hold independent reports the organization can accept, and how many suppliers must be assessed directly
Supply chain evidence collection	Supplier, at its own cost, reviewed by the organization	Recurring, as subcontractors and sub-suppliers change	Visibility into the supplier's own supply chain and whether the supplier maintains a current list of critical sub-suppliers
Evidence upkeep	Internal third-party risk or GRC owners	Recurring, for reassessments and monitoring of changes	Assessment cycle set by risk tier, automation of reminders and document expiry, and quality of the supplier record
Auditor sampling and testing	Independent auditor, paid by the organization being audited	Recurring with each audit cycle	Number of supplier files sampled, and whether the organization can show a consistent method and complete records
Readiness and implementation support	Implementation partner, under a written fixed scope	One-time for process and tooling setup, optional recurring retainer	Number of supplier categories, integration with existing procurement systems, and internal skills already in place

Who owns supplier assessment, who prepares it, and who audits it

Your organization owns ID.RA-10. It decides which suppliers are critical, which business and cybersecurity requirements apply to each of them, what evidence it accepts, and what it does when a supplier falls short. These are accountability decisions, and they cannot be delegated to a tool or a consultant. The Implementation Example NIST publishes for this Subcategory describes supplier risk assessments against business and applicable cybersecurity requirements, including the supply chain, so the organization must be able to show that the requirements were defined and that the assessments were carried out against them.

Critical supplier list: Maintain the list of suppliers treated as critical and the reason each one is on it, tied to the services they provide.
Requirement set: Approve the business and cybersecurity requirements each supplier must meet before acquisition.
Assessment decisions: Record who reviewed each assessment, what they concluded, and whether the supplier is approved, conditionally approved or rejected.
Risk acceptance: Document any gaps accepted by a named owner, with a plan to revisit them.
Supply chain questions: Decide how far the assessment reaches into the supplier's own critical subcontractors.

Before engaging anyone, confirm internally who signs off on supplier approvals and where those decisions are stored.

Where supplier assessments usually fall short

Most organizations assess suppliers somewhere in their process, but the assessment rarely covers the right suppliers, arrives at the right time, or feeds the decisions it is meant to inform. The gaps below are the ones assessors and internal reviewers tend to find first when testing ID.RA-10 Critical supplier assessment.

No maintained critical supplier list

Without a current list of which suppliers are critical, assessments depend on whoever happens to remember a vendor. ID.RA-10 is scoped to critical suppliers, so the list is the starting point for everything else. Check that it names each supplier, the service it provides, the systems and data it touches, and the business owner who would feel an outage first. Confirm the list is tied to the asset inventory in ID.AM and reviewed when new contracts are signed. Closing action: build the list from contracts and asset records, then assign each entry an owner and a criticality rating.

Assessments completed after signature

When the assessment happens after the contract is signed, the findings can only shape remediation terms, not the decision to buy. ID.RA-10 expects assessment before acquisition, so the sequence matters as much as the content. Check whether procurement can start a supplier review before a purchase order or statement of work is issued, and whether security holds a veto or a formal sign-off role. Closing action: add a security gate to the procurement workflow that blocks contract execution until the assessment is recorded.

Supply chains left unassessed

Many assessments stop at the first-tier supplier and ignore the providers that supplier depends on for hosting, subprocessing, or support. The ID.RA-10 Implementation Example explicitly reaches into the supply chain, so a supplier review that omits it is incomplete. Check whether the questionnaire asks which critical subcontractors and cloud regions the supplier uses, and whether the answers are compared against the critical supplier list. Closing action: add fourth-party questions to the assessment and record which subcontractors support each critical service.

Questionnaires that are never scored

A returned questionnaire full of narrative answers is not an assessment until someone judges it against defined requirements. Without scoring thresholds, two suppliers with very different controls can look identical in the file. Check that each question maps to a business or cybersecurity requirement, that answers have an agreed rating scale, and that a low score triggers a documented decision rather than a quiet approval. Closing action: define a pass, conditional and fail rating for each requirement and require a named approver to record any override.

Assessment results not linked to risk

An assessment that ends in a PDF in a shared folder does not change the risk picture. ID.RA-10 sits within the Risk Assessment Category, so findings should flow into the same register used for vulnerabilities, threats and risk responses. Check whether each unresolved finding has an entry in the risk register, a named risk owner, and a response such as mitigate, accept or transfer. Closing action: create a register entry for every open supplier finding and link it to the supplier record.

Stale assessments carried forward

A supplier assessed three years ago may now host different data, operate in other regions, or have experienced a material incident. Reusing the old file without re-testing leaves the organization assessing a supplier that no longer exists in that form. Check that reassessment is triggered by contract renewal, scope change, incident notice, or a change in the supplier's own subprocessors, and that the trigger is recorded. Closing action: set reassessment triggers in the supplier record and assign a date owner to each critical supplier.

Questions buyers ask about ID.RA-10 supplier assessment

How much effort does a critical supplier assessment take?

Effort depends mainly on how many critical suppliers you assess, how deep their own supply chains go, and how much evidence each supplier can produce without prompting. The work has a one-time part (designing the assessment method, criteria and questionnaire templates) and a recurring part (reassessing suppliers, reviewing answers when services change, and tracking open findings). Ask any partner for a quote built from a written list of suppliers, the data each one handles and the questions you need answered. Ask how the quote treats follow-up rounds with suppliers, since those usually drive the timeline more than the initial review does.

Can we run critical supplier assessments in-house?

Yes, many organizations do. NIST does not require a particular method, so the question is whether your team has the capacity and skills to set criteria tied to business impact, review supplier evidence, and record decisions. Common in-house gaps are reviewing supplier security reports, judging sub-supplier exposure and writing contract conditions that follow from findings. An implementation partner can help build the method, templates and evidence trail, and your own staff keep ownership of each risk decision. Only an independent auditor can issue an assurance report on your program.

How long does it take to set up a supplier assessment process?

The NIST CSF 2.0 materials supplied for this topic do not give a duration, so treat any number you hear as unverified. Setup time depends on the size of your supplier list, whether an inventory of suppliers and supplier services already exists under ID.AM, how many internal approvers must sign off, and whether your existing procurement system can hold assessment records. Confirm the timeline against your own environment and ask a partner to tie it to a written scope with named deliverables before work starts.

What does a supplier assessment need from procurement and legal?

Procurement and legal shape when an assessment can happen and what it can require. Procurement needs to insert the assessment into intake and renewal steps, so no critical supplier is onboarded before review is complete. Legal needs to write assessment rights, evidence-sharing duties, notification of changes to sub-suppliers and exit terms into contracts. Both teams should agree who decides when a supplier fails a requirement, because an assessment with no decision owner produces findings that never close. Ask your partner to list these hand-offs in the scope so each one has an owner and a date.

Does NIST certify suppliers against ID.RA-10?

No. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services, and it has no plans for a conformity assessment program. A supplier cannot be certified as compliant with ID.RA-10 by NIST. Evidence that a supplier meets your requirements comes from your own assessment, and where you need independent assurance, from an auditor who issues a report on the supplier's controls. Be wary of any vendor or consultant who claims NIST certification for a supplier or for your program.

How does ID.RA-10 differ from GV.SC-06?

GV.SC-06 concerns due diligence before entering a relationship with a supplier, and ID.RA-10 is the risk assessment counterpart that evaluates critical suppliers against business and cybersecurity requirements, including their supply chains. In practice, the two are used together: the due diligence step sets what you will look at, and the risk assessment records what you found and how the risk is handled. Keep the two linked in your records so a finding from ID.RA-10 can trigger the contract and onboarding steps described under GV.SC. Confirm how your own policy splits these duties before you map evidence to either Subcategory.

What drives the cost of supplier assessment up or down?

The main drivers are the number of critical suppliers, the sensitivity of data and systems they touch, the depth of their sub-supplier chains, and how much evidence they already publish. Suppliers with current, independently audited reports are faster to review than those that answer questionnaires from scratch. Recurring costs come from reassessment cycles, monitoring of supplier security events, and staff time to chase overdue evidence. When requesting a quote, ask for the assumed supplier count, the review depth per tier, the number of reassessment rounds and what is excluded.

How DeployOpen prepares supplier assessment evidence

DeployOpen prepares the supplier assessment evidence for ID.RA-10, but the organization decides which suppliers are critical, what each assessment must cover and whether a supplier is acceptable. Engagements start with a written scope that names the systems, the supplier population in question, the business and cybersecurity requirements the assessment will test against, and the deliverables. Before any configuration begins, the client should confirm who signs off on the criticality tiers, who owns each supplier relationship, and which decisions remain with the business. DeployOpen does not set those thresholds for the client.

Inside the client's own environment, DeployOpen can configure self-hosted tooling, such as a GRC platform, to hold supplier records, questionnaires, control mappings and review dates. The team builds assessment templates aligned to the requirements the client has chosen, including questions on the supplier's own supply chain, and assembles evidence packs for each supplier: the questionnaire responses, supporting documents the supplier provided, the reviewer's notes and the risk decision with its owner and date. Where the client wants to map supplier questions to the informative references NIST publishes for ID.RA-10, the team can prepare that mapping, but the client should confirm the mapping with its own assessors before relying on it.

Through review, DeployOpen supports the client's staff in walking through the packs, documenting gaps and preparing the material an independent auditor or assessor will ask to see. DeployOpen does not issue audit reports, attestations or certifications, and NIST does not certify CSF implementations. Any conclusion about a supplier's adequacy is the organization's own decision, and any formal opinion comes from an independent assessor the organization engages. Costs follow the written scope: the effort to build templates, configure tools and review packs is quoted up front, while questionnaire refresh and monitoring usually recur. The client should ask for each deliverable and its acceptance criteria in the quote.

ID.RA-10 Critical supplier assessment