Glossary
Supplier criticality
The classification that decides how much assessment depth and monitoring a third party warrants, based on the damage its failure would cause.
- Supplier tiering
Applying the same process to all hundred and eighty suppliers in the register guarantees it will be done badly for all of them. Criticality exists to allocate effort, and it derives reasonably well from three questions.
Which function does it support: if it underpins a critical or important function, it inherits that criticality. What data does it reach: processing personal data is not the same as never seeing it. And how reversible is it: a supplier replaceable in two weeks and one that would require an eighteen-month migration are not the same risk even if they do the same job.
The third question is the most forgotten and carries the most weight. Substitutability does not appear on security questionnaires, yet it determines what real options you have the day the supplier fails. DORA turns it into an obligation by requiring exit strategies for ICT services supporting critical or important functions.