iKNSA International
Self-assessment10 to 15 minClient areaContact iKNSA

Guidance by trigger

The triggering event determines the order of the analysis.

A questionnaire, an audit, market entry or the maintenance of several engagements each call for distinct decisions and levels of evidence.

Review situations

A client request exists

Security questionnaireContractual annexAnnounced auditFindings received

A decision needs to be prepared

RenewalEU call for tendersEU market entryProduct security

The role determines the mandate

The supplier examines its own capability. The European client defines the supplier decision it needs to reach.

Self-assess my organisation →Assess a supplier →Search the platform →

Choose an engagement

Meet the deadline. Establish capacity. Sustain commitments.

Start from what needs to be obtained now: an answer, an in-depth review, or a capability tracked over time.

View all engagements
01

Reply

A document and a deadline.

QuestionnaireAnnexAuditAll responses →
02

Prepare

Verify and remediate.

EU exposureClient and technical assessmentEvidence and remediationAll preparations →
03

Maintain

Keep the current commitments.

Continuous assuranceClient assurance officeProduct security cellAll recurring services →

Basis for the conclusions

From the client's requirement to a qualified piece of evidence.

The same trail links Promise, Policy, Practice, Platform, finding, remediation and controlled sharing.

Review the 4P method

Trace

Evidence traceabilityAssurance registerTrust roomContinuous verification

Frameworks and sectors

GDPR and international accessHealth data and HDSNIS2 and the supply chainIndustrial confidentialityAll frameworks →

View deliverables

See fictitious examples to understand the structure and depth of the deliverables.

See examples of deliverables →

Terms of engagement

Responsibilities, information and limits established before the engagement.

Confidentiality, independence, reversibility and traceability of responsibilities structure the conduct of the work.

Review the firm's rules

Trust rules

ConfidentialityIndependenceSecurityReversibility

Working with iKNSA

ExpertiseInternational engagementsRequest an engagementContact

European principals

Have an international supplier assessed under explicit mandate and sharing rules.

Assess a supplier →
Your contextContext not defined
Country of the organisation assessedNot provided
What it providesNot provided
Relationship with the EUNot provided
Home / Jurisdictions / United States

Country file

United States

The transatlantic relationship is substantial. The US context requires separately verifying the contract, the entity's DPF status and the impersonation risks specific to B2B relationships.

Relationship with the European Union

Transatlantic relationship — no blanket audit relief

The relevant mechanism here may be the Data Privacy Framework, but only for participating US companies; supplier requirements remain specific to the contract and the sector.

Sources reviewed on 14 August 2026

01

Economy and sectors

02

Incidents, fraud and impersonation

03

Points to check within your organisation

To be verified

Data Privacy Framework status

Check the receiving entity, its active participation and the scope covered; never extend it automatically to the group.

To be strengthened

Supplier instructions and payment

BEC specifically targets supplier relationships and payments: a contact register, an independent callback and dual validation can all be demonstrated.

To be tested

AI-assisted impersonation

Procedures must withstand a convincing email, voice or profile: the trusted channel takes precedence over the realism of the message.

Developments to be aware of

The topics that may change your answers

Email compromise

BEC is tracked separately from generic phishing because it directly affects client–supplier relationships.

FBI IC3, 2025 annual report
What this means for your situation

For a US supplier, the distinctive challenge is to align technical evidence with a robust B2B trust protocol. The DPF addresses certain transfers; it covers neither the integrity of client instructions nor the defensibility of a security response.

Official sources

Confidential exchange

Describe your European relationship and the request received.

Contact iKNSA