Cybatar Security Hub
Trust Center·Company facts
Security Hub
Menu
Platform Solutions Pricing Industries Use cases Resources Trust Center Company Contact
Client login Start free trial
Third-Party Cyber Risk / Methodology
Editorial & technical methodology

Cybatar Third-Party Cyber Risk Methodology

How Cybatar separates supplier criticality, due diligence, supporting evidence, findings, resilience, incidents, monitoring and product claims.

Published 2026-08-17Reviewed 2026-08-17

Method principles

Principle 1

Start from the business and technical dependency created by the supplier, not from a generic questionnaire score.

Principle 2

Scale due diligence and assurance depth according to criticality, access, data, concentration and recovery impact.

Principle 3

Keep supplier representations, supporting artefacts, independently verified facts, unknowns and exceptions distinguishable.

Principle 4

Treat evidence as time-bound: record scope, date, reviewer, freshness and the decision it supports.

Principle 5

Link findings to accountable treatment, due dates, exceptions and residual-risk decisions rather than merely recording questionnaire gaps.

Principle 6

Use event-driven review triggers such as incidents, material service changes, ownership changes, access changes and evidence expiry.

Principle 7

Connect third-party incidents to internal business impact, credentials, integrations, evidence and recovery decisions rather than waiting only for vendor communications.

Principle 8

Plan for exit: know how access, data, integrations, evidence and business continuity will be handled before a critical dependency must be replaced.

External source notes

NIST SP 1326Current 2026 NIST quick-start guide used for supplier due-diligence concepts.NIST SP 800-161 Rev. 1Used for cybersecurity supply-chain risk-management principles and ongoing risk treatment.NIST SP 800-160 Vol. 2 Rev. 1Used for cyber-resilience concepts such as anticipating, withstanding, recovering from and adapting to adverse conditions.NIST SP 800-18 Rev. 2Used for current system and C-SCRM planning concepts, including responsibilities, environments, components, data flows and risk decisions.

Explicit non-claims

  • Cybatar does not certify, accredit or endorse suppliers.
  • A questionnaire, certification or due-diligence review does not prove that a supplier is secure.
  • A criticality tier is not a universal vendor-security score.
  • Cybatar does not guarantee visibility into undisclosed supplier incidents, sub-tier dependencies or control failures.
  • Vendor-assurance software does not remove contractual, regulatory, privacy, legal, procurement or specialist assessment obligations.

How to use this methodology

Start from the supplier dependency, assign proportionate criticality, collect evidence that is scoped and dated, keep findings accountable, define review triggers, connect incidents and resilience results, and retain the decision trail. When a Cybatar page references NIST or another external source, preserve the external publisher’s status separately from the Cybatar interpretation.