Cloud accounting, CRM, ecommerce platforms, managed IT support and AI tools let small businesses operate with the capabilities of a much larger company. They can also create a concentration of risk: one supplier outage, compromised administrator account or poorly managed sub-processor can interrupt sales, expose customer information or leave staff unable to work.
That does not mean a small firm needs a procurement department, a 100-question security questionnaire or a solicitor reviewing every software renewal. It means applying sensible checks that match the supplier’s importance and the data or access it receives. The aim is simple: understand what could go wrong, obtain enough evidence to make a defensible decision, and make sure you can keep operating if the supplier has a bad day.
This matters increasingly in the UK. The government’s Cyber Security and Resilience (Network and Information Systems) Bill is intended to strengthen resilience in critical digital supply chains. As at 30 July 2026, the Bill has completed its Commons stages and is progressing through the House of Lords. Most small firms will not be directly regulated by it, but its direction is clear: supplier risk, managed services and incident readiness deserve closer attention.
Start with proportionality, not paperwork
Not every supplier deserves the same review. A design-tool subscription holding no customer data is different from the managed service provider (MSP) that has remote administrator access to every laptop, or the cloud accounting platform that contains bank details, invoices and payroll records.
The National Cyber Security Centre (NCSC) advises organisations to tailor supplier assurance to criticality and risk. Its supplier assurance questions highlight useful factors: the supplier’s connection to your IT, whether it is a single point of failure, the sensitivity and volume of data it handles, and its effect on important business functions.
Create a one-page supplier register. For every important IT, SaaS or data provider, record the service owner, renewal date, data held, system access, business impact and a simple rating: low, medium or high.
A practical three-tier model
- Low risk: a tool with no personal data, no connection to your systems and an easy replacement. Check reputation, basic security information and account controls.
- Medium risk: a SaaS platform holding ordinary customer, prospect or employee data, such as CRM, email marketing, helpdesk or ecommerce software. Check data-processing terms, MFA, backups or export options, sub-processors and incident contacts.
- High risk: an MSP, cloud accounting or payroll provider, ecommerce payment-related provider, identity provider, hosting platform, or AI service receiving sensitive or confidential information. Carry out all medium-risk checks, request meaningful evidence, document the decision and involve your IT lead or external adviser.
Risk can change. A low-risk AI writing assistant becomes a higher-risk supplier if staff start pasting customer complaints, commercially sensitive pricing or HR information into it. Review a supplier when its access, data use or importance changes—not only at renewal.
The small-business vendor review checklist
Use the following checklist before buying a material service and when reviewing existing critical suppliers. A supplier should be able to answer most of these questions clearly. A vague response is not always a deal-breaker, but it is a reason to reduce permissions, seek alternatives or add protections of your own.
1. Access controls: who can get in, and how?
First establish exactly what the supplier can access. “We host your website” is not enough. Can its staff log in to your Microsoft 365 tenant, accounting system, ecommerce administration panel, customer database, laptops, network or backups? Can it reset passwords? Does it have a shared administrator account?
Ask the supplier:
- Does it enforce multi-factor authentication (MFA) for its own privileged staff and for your administrator accounts?
- Are individual, named accounts used rather than shared logins?
- Is privileged access limited to people who need it, approved and reviewed regularly?
- Is remote access time-limited, logged and protected by MFA?
- How quickly are staff and contractor accounts removed when roles change or people leave?
- Can you see an audit log of administrator activity, sign-ins and major configuration changes?
For SaaS services, turn on MFA yourself, remove unused administrators and use roles that give finance, sales and support staff only the permissions they need. For an MSP, insist on named access, not a permanent shared “support” account. The NCSC’s guidance stresses that knowing and controlling who has access to a network is a core part of basic cyber hygiene.
Also check your side of the boundary. A secure supplier cannot compensate for a director sharing an ecommerce admin password by email or for an ex-employee retaining access to the CRM. Make one person accountable for approving new admins and reviewing them at least quarterly for high-risk systems.
2. Backups and recovery: can you actually get back to work?
“It is in the cloud” does not automatically mean that your data is backed up in a way that meets your needs. A provider may protect its platform from hardware failure while offering only limited recovery of a deleted file, corrupted record, accidental bulk change or ransomware-encrypted synced folder.
Ask what is backed up, how often, where copies are held, how long they are retained and whether restoration is tested. Crucially, ask whether you can export your own data and attachments in a usable format. For cloud accounting, CRM and ecommerce, test an export before you need one; a spreadsheet containing only partial records is not a recovery plan.
The NCSC recommends keeping important backups separate from the systems they protect and notes that up-to-date backups are an effective way to recover from ransomware. Its small-business response and recovery guidance is a useful starting point for building your own plan.
For every high-risk supplier, write down two targets: how long you could tolerate the service being unavailable, and how much recent data you could afford to lose. A retailer may need its ecommerce platform back within hours; a small consultancy might cope with a day without CRM but not with losing months of project files. Those answers determine whether a second export, offline copy, alternative payment method or manual process is necessary.
3. Incident contacts: will you hear quickly and reach the right person?
A supplier’s generic support mailbox is not an incident plan. Obtain a security or incident contact, a 24/7 escalation route for critical services, and the process it will follow if it suspects that your data, account or service has been affected.
Ask whether the supplier will tell you about a security incident without undue delay, what facts it will provide, and how it will support your investigation. Useful details include the systems affected, data types involved, likely start and containment times, actions taken, recommended customer actions and next update time.
Your contract should state who contacts whom and through which channels. This matters because, where personal data is involved, a controller may need to assess whether it must notify the ICO. The ICO explains that processor contracts need provisions covering security, support with personal-data breaches and end-of-contract arrangements in its guidance on processor contracts.
4. Data location and sub-processors: where does information travel?
Ask where the supplier stores and processes data, including backups, support access and analytics. “UK hosted” may describe the primary production environment but not logs, disaster-recovery copies, customer support or subcontractors. Request the supplier’s current sub-processor list and ask how you will be notified of material changes.
Location alone is not a security verdict, and a UK business may legitimately use global suppliers. However, you need to understand the flow. If the arrangement involves a restricted international transfer of personal data, check the mechanism and safeguards rather than relying on a marketing statement. The ICO’s international transfers guidance explains the steps organisations should consider.
Be especially careful with tools that combine data from many sources. A CRM plug-in may copy contacts into a separate environment; an AI meeting assistant may retain recordings and transcripts; an ecommerce app may send order information to its own analytics provider. Use the minimum data needed, switch off optional sharing where possible and avoid uploading special-category, financial or highly confidential data unless there is a clear business case and appropriate assurance.
5. Offboarding: can you leave cleanly?
A vendor review is incomplete until you know how the relationship ends. Ask how you retrieve data, what format it will be in, how long you have to download it, whether it charges for extraction, and when it deletes production data, backups and derived copies after termination.
Offboarding also means access removal. Confirm that supplier credentials, API keys, OAuth connections, forwarding rules, remote-management agents and integrations can be identified and revoked. Keep an internal checklist for departing staff and changing suppliers. Otherwise, an old CRM integration or former MSP account can remain a quiet route into your systems.
The ICO’s small-business information-security checklist notes that processor contracts must include a term requiring the processor, at the controller’s choice, to delete or return personal data at the end of the contract. Make that operational: nominate an owner, download the export, verify it opens, revoke access and obtain deletion confirmation where appropriate.
Which certifications matter—and what they do not prove
Certifications can save time, but they are evidence, not a substitute for thinking. Cyber Essentials can provide helpful assurance that a UK supplier has addressed baseline technical controls. ISO/IEC 27001 can indicate that an organisation operates an information-security management system. Larger cloud suppliers may offer independent assurance reports such as SOC 2, although access may be restricted by confidentiality terms.
Request the certificate name, scope, issuing body and expiry date. The word scope matters: a certificate covering a supplier’s head office does not necessarily cover the product, cloud environment or support operation that will handle your information. Ask whether significant subcontractors are included and whether any major exceptions or corrective actions are open.
Do not reject a capable small supplier merely because it cannot afford a formal certification. Ask for alternative evidence proportionate to risk: its security policy summary, MFA policy, backup and recovery description, penetration-test summary, vulnerability-management approach, incident-response process, staff security training summary and recent independent assessment where available. Equally, do not accept a logo on a website without checking it.
Extra checks for managed IT and AI providers
Managed IT providers need the deepest scrutiny
An MSP can be your strongest defence or your largest concentration of privilege. Ask for a list of every system it administers, named administrator accounts, its remote-management and remote-access tools, logging arrangements, patching responsibilities, endpoint-security tools, and the process for approving high-risk changes such as creating global administrators or changing bank details.
Agree a simple responsibility matrix. For example: the MSP applies laptop patches and monitors alerts; your finance director approves payment-system users; your operations manager owns SaaS access; both parties maintain incident contacts. Ambiguity creates gaps, particularly during an attack.
AI suppliers require a data-use question
For generative AI, ask more than “is it secure?” Establish whether prompts, files, outputs, recordings or usage data are retained; whether they may be used to train models; whether this can be disabled; which model and sub-processors are involved; and what enterprise controls exist for identity, audit logs, data retention and administration.
Set a short internal rule: staff must not paste personal data, customer secrets, credentials, payment information, legal advice or unpublished financial information into public AI tools unless the business has approved that specific service and use case. Where an AI tool is approved, configure the business account, restrict who can connect data sources, and give staff examples of acceptable and unacceptable input.
Request evidence without making procurement a legal project
For medium-risk vendors, send a concise checklist and request links to standard materials. For high-risk vendors, ask for the same evidence plus a call with its security or technical contact. Keep the answers, documents and your decision in the supplier register. The point is to show a repeatable process, not to create an enormous file nobody reads.
- Privacy notice, data-processing agreement and sub-processor list.
- Security overview covering MFA, encryption, access management, monitoring and vulnerability management.
- Business continuity, disaster recovery and backup summary.
- Incident-notification and escalation process.
- Current certificates or independent assurance summary, including scope and expiry.
- Data residency, international-transfer and retention information.
- Export, deletion and access-revocation process at contract end.
If the supplier cannot answer basic questions, will not enable MFA, gives no incident route, cannot explain where data goes or makes it difficult to leave, treat that as decision-grade information. You may still proceed for a low-risk service, but only with limited data and permissions. For a high-risk service, it is usually a reason to look elsewhere or seek specialist advice.
Make vendor assurance a routine business control
Put a 30-minute annual review of critical suppliers in the calendar, with an additional review after a significant incident, major product change, acquisition, new AI feature, data expansion or change in the supplier’s access. Check whether certificates remain current, administrators are still appropriate, recovery exports still work and incident contacts still answer.
Good supplier assurance is not about assuming every provider will fail. It is about choosing providers with open, workable security practices and ensuring your own business is not helpless if they do. Start with the systems that hold money, customer data and administrator access. Complete the checklist, fix the obvious gaps and make vendor cyber risk an ordinary part of how your business buys technology.
Call to action: This week, list your five most critical IT, SaaS and data suppliers. For each one, identify its data, access, incident contact and exit route. If you cannot answer those four questions in ten minutes, that supplier is the right place to begin your review.
