Your supplier passed due diligence. What happens on Tuesday?

The questionnaire is complete. The security documentation has been reviewed. The contract is signed.

Your supplier is approved.

On Tuesday morning, someone in finance receives an email asking them to use a new payment portal. An operations manager gets a request to share documents through a different platform. An engineer is asked to extend a supplier’s access to help resolve a fault.

Each request appears to come from a company the organisation has already assessed.

What happens next?

That is where supplier assurance needs to reach beyond the procurement process and into the working day.

Approval has a scope

A supplier assessment can establish important facts: what controls the supplier has, how it handles information, which services it provides and whether the proposed relationship falls within your organisation’s risk appetite.

That work matters. It creates the foundation for a responsible commercial relationship.

But an approval relates to a particular scope, supported by particular evidence.

A supplier approved to maintain equipment has not necessarily been approved to receive a copy of your customer database. A service assessed for one department may require another review before it becomes business-critical infrastructure.

Similarly, confidence in a supplier’s security arrangements does not authenticate every message sent in its name.

“Approved supplier” is useful information. It is an incomplete answer to “Should we do this?”

The relationship can change between reviews

Consider a fictional supplier that passed a thorough assessment in January.

By April, your team relies on its service for an additional business process. In June, it introduces a subcontractor. In August, a temporary support account receives broader permissions to resolve an incident.

Each change may have a reasonable explanation. Together, they may create a relationship substantially different from the one originally assessed.

There is no need for an attacker to be involved for this to matter. Dependencies, access and data flows can expand through ordinary business decisions.

A scheduled review can identify those changes later. An effective assurance process also needs a way to recognise consequential changes when they happen.

The NCSC’s supply chain guidance includes embedding controls throughout the contract, monitoring supplier security performance and continually improving the approach. Ongoing assurance is part of the relationship, rather than something completed at onboarding.

Tuesday’s request creates a separate decision

Return to the email about a new payment portal.

There are several possible explanations:

• The supplier is introducing a legitimate service.

• An employee has shared an unapproved workaround.

• An attacker is impersonating the supplier.

• A genuine supplier account has been compromised.

The existing approval does not distinguish between them.

Nor should every change be treated as evidence of an attack. Businesses change systems, employees make mistakes and suppliers introduce new services.

The task is to establish what changed, whether it is authorised and what evidence is needed before acting.

For a new portal, that might mean verifying the destination and confirming the change through an established supplier contact. For expanded technical access, it means checking the business need, permissions, authorisation and duration.

The required check follows the consequence of the request.

Three layers of assurance

A practical approach separates three related questions.

Supplier: Is the organisation suitable for the relationship?

Service: Are we still using the service withint the conditions we assessed?

Interaction: Should this particular request proceed?

These layers support one another.

A strong supplier assessment helps establish the expected relationship. Service oversight identifies changes to that relationship. Checks during individual interactions help people act safely within it.

The difficulty comes when evidence from one layer is used to answer every question at the others.

Continuous assurance needs clear triggers

“Continuous” can sound like a requirement to investigate every supplier, every minute.

A more practical starting point is to identify events that should trigger a check.

Examples include:

A new destination.
A supplier introduces a different domain, file-sharing location or payment portal.

A change in authority.
Someone requests broader access, additional recipients or permission to bypass an existing approval.

A change in exposure.
The service begins handling more sensitive information or supporting a more critical operation.

New adverse evidence.
A credible notification or intelligence finding raises a concern about an account, domain or service involved in the relationship.

Each trigger should have a defined response and an owner. Otherwise, detecting the change simply creates another unresolved alert.

The response should also be proportionate. A routine contact update and a request for privileged system access should not generate identical workflows.

Where trust intelligence contributes

Current intelligence can help assess the digital entities involved in a supplier interaction.

For example, a newly introduced portal might use a domain associated with observed phishing activity. A link might lead to infrastructure with credible evidence of malicious use.

That information can give the recipient a reason to pause before sharing credentials or information.

Its limits matter too. An external domain assessment cannot confirm that a supplier authorised a bank-account change. A favourable result cannot establish that a request for additional access is commercially necessary.

For payment changes, the FBI recommends independent verification, including calling to confirm the request and avoiding contact details supplied by a potential scammer.

Threat intelligence contributes evidence about risk. Business processes establish who can authorise the action. Both need to reach the person making the decision.

Close the gap between finding and action

Suppose the security team identifies a concern with a supplier’s document-sharing portal.

Who needs to know?

The procurement owner may manage the relationship, but the people uploading files could sit across finance, HR and operations. A finding recorded only in the supplier’s risk file may never reach them before their next interaction.

A useful process connects the finding to the affected activity:

Pause uploads to this portal while the concern is investigated. Use the previously approved transfer route. Contact the service owner for urgent requests.

That instruction defines the scope, provides an alternative and identifies responsibility.

It also avoids treating the entire supplier as malicious when the evidence concerns one service.

Measure what happens after approval

The proportion of suppliers assessed is a useful measure. It does not reveal whether changes are recognised or findings acted upon.

Additional measures could include:

• How quickly material changes reach the responsible owner.

• Whether sensitive requests receive the required verification.

• How long temporary access remains active.

• How quickly relevant findings reach affected teams.

• Whether corrective actions are completed and checked.

The NCSC recommends establishing measures for supply chain security management and acting on findings and lessons learned. The choice of measures should help reveal whether assurance is working in practice.

Bringing assurance into the working day

At ThreatPrevent, our focus is bringing high-confidence intelligence signals into the decisions people make as they encounter domains, email addresses and IP addresses.

In a supplier relationship, those signals can help connect security knowledge with everyday activity. They complement the assessments, authorisation processes and verification steps that establish how the relationship should operate.

The aim is to help people recognise when a familiar interaction needs a fresh check.

Your supplier passed due diligence. That established a basis for working together.

What helps your team decide whether Tuesday’s request should proceed?