The assessment criteria

Quality management, conformity to requirements and the handling of defects and complaints.

• Quality management system

  Evidence document possible

  Is a QM system in place – certified to ISO 9001 or otherwise equivalent?

• Complaint and defect management with a defined process

  Evidence document possible

  Is there a documented process for handling complaints (e.g. 8D)?

• Conformity to agreed requirements assured

  Evidence document possible

  Is compliance with agreed specifications (dimensions, material, standards, scope of services) assured?

• Response time for complaints

  Evidence document possible

• Traceability / batch tracking

  Evidence document possible

• Incoming and final inspection documented

  Evidence document possible

  For physical products: are incoming and final inspections documented?

• First-article inspection (PPAP) possible

  Evidence document possible

• Average defect rate

  Evidence document possible

  Self-reported average defect rate in ppm (for information only).

Lead times, delivery terms and the ability to deliver reliably and flexibly.

• Binding committed delivery time

  Evidence document possible

  Are binding delivery times committed and met?

• Average lead time

  Evidence document possible

• Incoterms 2020 offered

  Evidence document possible

  Which delivery terms are offered?

• Shipping / warehouse location

  Evidence document possible

• Safety stock / emergency supply possible

  Evidence document possible

• Call-off orders / consignment stock / VMI possible

  Evidence document possible

• Use of subcontractors is disclosed

  Evidence document possible

  Are subcontractors for production or shipping transparently disclosed?

Payment and delivery terms and the commercial framework of the cooperation.

• Standard payment terms

  Evidence document possible

• Early-payment discount offered

  Evidence document possible

  Is an early-payment discount granted? (percentage optional in the notes field)

• Acceptance of general purchasing terms (GPC)

  Evidence document possible

• Price stability / price fixing

  Evidence document possible

  Are prices fixed for a defined period?

• Reference customers available on request

  Evidence document possible

• Billing currency

  Evidence document possible

Manufacturing depth, capacity and development competence – largely industry-specific.

• Manufacturing depth: in-house vs. outsourced

  Evidence document possible

• Capacity reserves even at peak times

  Evidence document possible

  Are there capacity reserves to deliver even during demand peaks?

• In-house product development / R&D

  Evidence document possible

• Number of production/service sites

  Evidence document possible

Technical and organisational measures for protecting information.

• Multi-factor authentication (MFA) mandatory

  Evidence document possible

  Is MFA enforced for all employee access to business-critical systems?

• Encryption in transit (TLS 1.2+)

  Evidence document possible

• ISO/IEC 27001 certified

  Evidence document possible

  Is there a certified information security management system (ISMS)?

• Encryption of data at rest

  Evidence document possible

• SOC 2 Type II report available

  Evidence document possible

• Penetration testing

  Evidence document possible

  How often are external penetration tests carried out?

• Established vulnerability management process

  Evidence document possible

• Regular security awareness training

  Evidence document possible

• Backups in place and restore tested

  Evidence document possible

• TISAX label (automotive)

  Evidence document possible

  For the automotive industry: is a valid TISAX label available?

Compliance with the EU General Data Protection Regulation and related rules.

• GDPR compliant

  Evidence document possible

  Does the company declare full compliance with the GDPR?

• Data residency

  Evidence document possible

  Where is personal data primarily stored?

• Data processing agreement (DPA) available

  Evidence document possible

  Can a DPA pursuant to Art. 28 GDPR be provided? "Not applicable" if there is no access to personal data.

• Data protection officer appointed

  Evidence document possible

• Sub-processors disclosed

  Evidence document possible

• Breach notification deadline

  Evidence document possible

  Committed deadline for notifying the customer of an incident.

• Records of processing activities (Art. 30 GDPR)

  Evidence document possible

• Technical & organisational measures (TOM) documented

  Evidence document possible

Creditworthiness, insurance cover and economic key figures.

• Business liability insurance

  Evidence document possible

• Business liability coverage sum

  Evidence document possible

• Credit rating / index

  Evidence document possible

  External credit assessment (e.g. Creditreform).

• Annual revenue

  Evidence document possible

• Revenue trend (last 3 years)

  Evidence document possible

• Cyber insurance in place

  Evidence document possible

Contingency management, availability and transparency about dependencies.

• Business continuity plan (BCP) in place

  Evidence document possible

• Documented incident response plan

  Evidence document possible

• ISO 22301 (BCM) certified

  Evidence document possible

• Recovery time objective (RTO)

  Evidence document possible

• Support availability

  Evidence document possible

• Committed availability (SLA)

  Evidence document possible

  For IT/cloud services: what availability is committed?

• Single-source dependencies made transparent

  Evidence document possible

• Willing to disclose revenue concentration risk (>30%)

  Evidence document possible

Environment, social, governance plus supply-chain due diligence and material compliance.

• Code of conduct established

  Evidence document possible

• Anti-corruption policy

  Evidence document possible

• CO₂ accounting (corporate carbon footprint)

  Evidence document possible

• Carbon-neutrality target (target year)

  Evidence document possible

• Product carbon footprint (PCF) available

  Evidence document possible

• Whistleblower system established

  Evidence document possible

• Supply chain due diligence (LkSG) met

  Evidence document possible

  Compliance with the German Supply Chain Due Diligence Act (size-dependent).

• REACH compliance

  Evidence document possible

  For chemical substances / physical products: compliance with the REACH regulation.

• RoHS compliance

  Evidence document possible

  For electrical/electronic products: compliance with the RoHS directive.

• Conflict minerals declaration (CMRT)

  Evidence document possible

  For electronics/metals: is a conflict-minerals declaration (CMRT) available?

Additional industry and management standards with valid evidence.

• ISO 14001 (environmental management)

  Evidence document possible

• Additional certifications

  Evidence document possible

  Select applicable standards.