Being assessed as a critical supplier¶
Scaldimet as a supplier¶
The previous Lesson looked at TPRM from Scaldimet's perspective as a customer. Now consider the other side: Scaldimet is itself the supplier. To its OEM customer, Scaldimet is the supplier, and a critical one: it makes precision parts the carmaker's own production depends on, and it holds the OEM's design data. So everything Scaldimet does to its suppliers, the OEM does to Scaldimet. The contract condition that started this whole story (the demand for ISO 27001 and NIS2 readiness) is not a regulator's order; it is the OEM running TPRM on Scaldimet, exactly as Lesson 4.8.A describes. This shows why the same evidence and control environment can support both Scaldimet's own TPRM activities and its customer's assessment.
What being assessed looks like¶
From this side, the assessment Scaldimet receives is the same instrument it sends: a questionnaire, a demand for evidence (the ISO 27001 certificate, the CyFun label), possibly an audit or a right-to-audit clause, and security obligations written into the supply contract. The OEM tiers its own suppliers, and Scaldimet, with privileged access to design data and a direct line into the OEM's production schedule, sits in the OEM's top tier, which is why the scrutiny is heavy and the contract renewal is conditional on it.
This reframes the Module 3 work. The socle was not built only to satisfy a law; it was built to answer this assessment. When the OEM's questionnaire asks "do you segment your OT, monitor third-party access, hold a recognised certification", Scaldimet's, evidenced "yes" is precisely the output of the compliance programme and the risk treatment. In this context, evidenced compliance also has commercial value: it supports the supplier relationship and the contract.
Responding well¶
Being assessed requires an established process. A few principles make Scaldimet good at it:
- Have the evidence ready. The register, the SoA, the certificate, the control-test results (the evidence discipline of Lesson 3.5.A) should be assemblable on demand, not reconstructed each time a customer asks.
- Answer honestly. Overstating your security to pass a customer assessment is the check-box trap turned outward, and it converts a security gap into a contractual and reputational liability when an incident exposes the gap.
- Treat the customer's findings as input. If the OEM's assessment flags a weakness, that finding feeds Scaldimet's own risk register and roadmap. The customer is, in effect, doing some of Scaldimet's risk identification for free.
- Manage it as a relationship. A critical-supplier relationship involves recurring reassessment, incident-notification duties flowing to the customer, and sometimes joint exercises. It is ongoing, like the supplier monitoring of the previous Lesson, just from the other chair.
Scaldimet in the middle of the chain
Scaldimet is both a customer and a supplier within the same supply chain. The controls and evidence used for its suppliers can also support the assessments performed by its OEM customer.
Application: answer the OEM¶
On paper, write how Scaldimet would respond to three questions from the OEM's supplier-security assessment: do you hold a recognised certification, do you monitor third-party access to systems handling our data, and do you have an incident-notification process that would alert us. For each, name the specific Module 3 or Module 4 output that provides the evidenced answer.
Model answer (open after you've drafted yours)
-
Recognised certification? Yes: ISO 27001, scoped to both sites including the OEM design data, with the CyFun Important baseline behind it. Evidence: the certificate and the Statement of Applicability (Lessons 3.3, 3.5).
-
Monitored third-party access to systems handling your data? Yes: the maintenance contractor's remote access is individually authenticated, logged and reviewed. Evidence: the third-party-access applied control (3.5.A) with its review records, and the treatment recorded for the line-halt risk (4.6).
-
Incident-notification process that would alert us? Yes: an incident procedure that triggers the NIS2 reporting clock (24h / 72h / 1 month, Lesson 3.4) and a contractual notification to affected customers. Evidence: the incident process and the register entry (4.7).
Every answer points to work already done and evidenced, which is what makes Scaldimet a strong supplier. Any answer that could only be "we intend to" is a gap to close before the assessment, not during it: an overstated "yes" is the check-box trap turned outward, and it becomes a contractual liability the moment an incident exposes it.
Key takeaway
Scaldimet is itself a critical supplier to its OEM, so it receives the same TPRM instrument it sends: questionnaires, evidence demands, certification requirements, audit rights and contractual security obligations. This reframes the compliance work: the evidence can support the OEM's supplier assessment and therefore the contractual relationship. Respond well by keeping evidence ready, answering honestly (overstating is the check-box trap turned outward), treating the customer's findings as free risk input, and managing it as an ongoing relationship. The same discipline, and the same evidence, runs in both directions of the supply chain.