The success of a business is often linked to identifying reliable and cost-effective services suppliers. So it is the need to thoroughly review data security capabilities a potential service supplier has, especially when processing and storing of sensitive data is in scope. From identifying shortcomings in common approaches used by the industry to assess suppliers’ data secu- rity capabilities - to recommendations on effective assessment process improvements, this presentation provides a practical guide to supplier security risk assessment.