When this guide is useful
Procurement, IT and business teams choosing a cloud application or renewing an important service
- Procurement has a certificate but cannot map it to the proposed product or location.
- The supplier will receive customer data, yet no one has drawn the data flow.
- A service is becoming business-critical without a recovery or exit plan.
- A long questionnaire produces reassuring answers but few verifiable documents.
Classify the purchase before sending a questionnaire
Write a brief service profile covering users, data types, integrations, administrator access and business consequence if the service fails. A public design tool and a system holding confidential customer records should not receive identical scrutiny. Identify the internal business owner and the people responsible for security, privacy and commercial approval.
NCSC supply-chain guidance encourages organisations to understand and manage supplier risk over time. Turn that into a proportionate review: decide which questions are essential for this use and what evidence would answer them. Keep the assessment tied to the proposed service boundary, rather than the supplier's broad corporate marketing.
Ask for evidence that matches the risk
For identity and access, ask how your administrators will enforce authentication, assign roles and remove access. For integrations, establish the permissions required, credential ownership and available audit records. For resilience, ask what service commitments, recovery arrangements and export mechanisms apply to your subscription and data.
When reviewing independent assurance, check the named entity, covered product or operations, period, exclusions and current status. A hosting provider's certificate does not automatically certify the SaaS application or your configuration. If detailed reports require a confidentiality agreement, agree who can review them and how the resulting decision will be recorded without redistributing restricted material.
Resolve responsibility and contractual gaps
Translate the technical answers into a responsibility table. Include account administration, configuration, data location, incident notification, support access, subcontractors and deletion at exit. NCSC's cloud principles provide a useful range of questions, but the final arrangement must be checked against the service documentation and contract.
Document unanswered questions and proposed mitigations before purchase. A mitigation might be limiting the data uploaded, reducing an integration's permissions or requiring a supported export. Record the owner who can accept the remaining risk and any condition that must be met before live use. Do not silently convert an unknown answer into a pass.
Keep the review alive through renewal and exit
Set review triggers such as a new AI feature, new integration, ownership change, different processing location or a major incident. Ask the business owner whether actual usage has expanded beyond the original approval. A low-risk tool can become a critical record system simply because staff start relying on it.
Test the exit route while the relationship is healthy. Confirm what records, attachments, metadata and configuration can be exported and how they can be used elsewhere. Include costs, time limits and any supplier assistance needed. Keep renewal decisions connected to this evidence rather than treating security review as a document completed only at onboarding.
From diagnosis to delivery
How Britixo can help
Britixo can help structure the technical part of a supplier review, assess integration permissions and translate requirements into an implementable operating model. A scoped engagement can produce a service profile, evidence-gap register, access design and practical exit or migration considerations. We can also help remediate configuration gaps after a supplier is selected. Contact Britixo with the proposed service, intended data use and any procurement requirements. Independent certification, legal review, commercial negotiations and acceptance of business risk remain separately defined responsibilities; a technical review does not create a blanket compliance assurance.
Talk through your requirementsCommon questions
Is an ISO certificate enough to approve a SaaS service?
Not by itself. Check its entity, scope and validity, then assess the specific product, configuration and contractual responsibilities relevant to your use.
Should every supplier complete the same questionnaire?
A common baseline helps consistency, but the depth should reflect access, data and business impact. Excessive irrelevant questions can obscure the important unanswered ones.
What if the supplier will not provide a full audit report?
Ask what alternative evidence is available and record the remaining uncertainty. The authorised risk owner should decide whether limits, mitigations or another supplier are appropriate.
Sources and further reading
Use the original documentation to check current product terms, eligibility and technical details.
Published by Britixo on 29 October 2026. How these guides are prepared. Product availability and delivery scope are confirmed for your requirements.