# Service criticality and scope card

SecNet.Work · Supplier security and continuous assurance · 2026.10

Assess the service rather than the company name.

Blank organizational workpaper. Enter real contact, asset and data details only in a controlled organizational copy. This file is not evidence, organizational approval or an automated compliance decision.

- Use controlled organizational references for actual data and contact details.

| Service | Business owner | Data / access | Disruption impact | Review rationale |
| --- | --- | --- | --- | --- |
|  |  |  |  |  |
|  |  |  |  |  |
|  |  |  |  |  |
|  |  |  |  |  |
|  |  |  |  |  |

## Approval and follow-up

| Version | Owner | Approval | Review |
| --- | --- | --- | --- |
|  |  |  |  |

## Official references

- [NIST SP 800-161 Rev. 1 Update 1 — Cybersecurity Supply Chain Risk Management](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final)
- [UK NCSC — Supply chain security: understand the risks](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/understand-the-risks)
- [UK NCSC — Supply chain security: check your arrangements](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/check-your-arrangements)
- [UK NCSC — Supply chain security: continuous improvement](https://www.ncsc.gov.uk/collection/supply-chain-security/principles-supply-chain-security/continuous-improvement)