With hundreds of suppliers, how do you decide which must hand over a component inventory?

## Why uniform demands collapse The instinct after a supply chain incident is to send every supplier the same questionnaire and the same clause. It fails predictably. Enforcement capacity is finite: someone has to chase non-delivery, read what arrives and escalate. Goodwill is finite too — a vendor pushed hard on a low-stakes ask remembers it when you need something real. And the demand is often simply the wrong one for that supplier, which teaches everyone involved that the exercise is theatre. ## Axis one: exposure Rank by **what the supplier can reach if things go wrong**, not by spend. Roughly, in descending order: - Software that **executes inside your trust boundary** — libraries and images you build into your own artifacts, agents installed on your hosts, anything running on the path to production. A compromised dependency here becomes your compromise. - Vendors with **standing access to production systems or data** — managed operators, support tooling with live credentials, remote administration. - **Hosted services holding sensitive data** where the vendor's own breach is your notification obligation. - Vendors touching **safety, money movement or audit truth**, where the loss is not confidentiality at all. - Everything else, including most productivity tooling with no data of consequence. Name the **asset** at each tier deliberately. A payroll platform holds personal data for every employee; a managed database operator holds customer data and effectively holds credentials; a device supplier may hold the safety of a physical process. These are different losses and they justify different evidence. ## Axis two: replaceability, which is really leverage What you can demand is bounded by what you can walk away from. A commodity SaaS with five competitors will sign your clause; a single-source vendor whose product is embedded in a certified process will not, whatever your policy says. Being explicit about this prevents the common failure where a policy demands evidence nobody can obtain, and the whole programme loses credibility. ## Matching evidence to the threat, not to the template The most valuable move at this level is refusing to ask for the wrong artifact. A component inventory answers *what is inside this build*. It is the right ask when the supplier ships you code that runs in your boundary. For a **managed database operator with standing production access**, it is the wrong ask. Their control-plane component list is not what threatens you; the realistic threat is a compromised or malicious operator using entirely legitimate access. The evidence you want is about people and access: which roles can reach customer data, whether access is standing or brokered per task, what approval gates it, how it is logged, whether logs are available to you, and how quickly access is revoked when someone leaves. Ask for the inventory too if it is cheap — but do not let it stand in for the control that actually matters. Similarly for a **model-serving vendor**: the serving stack is ordinary software and an inventory of it is worth having, but the artifact carrying the value is the model file. There the questions are where the weights came from, who can publish a new version, and how you can tell which weights served a given request. ## Making the tiering survive contact with reality - **Keep the tiers few.** Two or three. A five-tier model with per-vendor exceptions becomes a spreadsheet nobody maintains within two quarters. - **Attach the classification to events that already happen** — procurement intake, renewal, and any change that moves a supplier onto the production path — rather than an annual review nobody schedules. - **Make each tier a template clause**, so the common case is a default rather than a negotiation. - **Instrument non-delivery**, because an obligation nobody checks behaves like no obligation. ## The escalation you must be willing to make For a critical supplier that will not comply, decide explicitly rather than by drift. Either buy the risk down with controls you own — isolate it, constrain its credentials, monitor its behaviour, reduce the data it can reach — or fund the exit and treat migration cost as the price of the evidence gap. Both options cost money, which is why the decision belongs with whoever owns that budget, not with the security team alone. The failure mode to avoid is a permanently open finding that everyone has stopped reading. ## What good looks like A small number of tiers; a clear statement of what evidence each tier owes and why; asks placed at renewal where leverage exists; deliberate substitution of access evidence where component evidence is beside the point; and an honest list of suppliers where you are knowingly buying compensating controls instead of assurance. That last list is the mark of a mature programme, not an embarrassing one.