Insights / Guide / Cybersecurity and IT resilience
GuideManaging supplier and third-party risk
Many incidents begin outside your organisation. Suppliers with access to your data or systems extend your risk, and a few simple habits keep that risk in proportion.
Many incidents begin outside your organisation. A payroll provider is breached, a support contractor’s laptop is stolen, a software update from a trusted vendor carries something it should not. Your own controls may be sound, yet your data is exposed or your systems are down because someone you rely on had a bad day.
Suppliers with access to your data or systems extend your risk. That is not a reason to stop using them: specialist providers often run services more securely than a mid-sized organisation could alone. It is a reason to know who they are, what they can reach and how they would behave in an incident. This guide sets out a proportionate approach that most organisations can run without a dedicated team.
Why third parties matter more than they used to
Ten years ago, most business systems sat in a server room the organisation controlled. Today a typical company runs email, finance, HR, customer records and file storage through cloud services, and relies on outside firms for IT support, payroll, marketing and development. Each of those relationships is a door into the business.
Attackers know this. A supplier that serves hundreds of clients is a more efficient target than any single one of them, and a smaller supplier with weaker defences can be the easiest route into a larger customer. The risk is not only theft. A supplier outage can stop order processing, billing or production just as surely as an attack on your own network.
List the suppliers with access
You cannot manage what you have not listed. Start with a single register of every external party that holds your data or can reach your systems. Include software, service and cloud providers, not just the firms with a formal outsourcing contract.
- Cloud and software services: email, file storage, finance, CRM, HR and payroll platforms, and the smaller tools teams have signed up for themselves.
- Service providers: managed IT support, developers, consultants, marketing agencies and anyone with a login to your systems.
- Infrastructure: hosting, internet and telephony providers, and the firms that maintain building or production systems connected to your network.
- Data processors: anyone who receives customer or employee personal data, including mailing houses and survey platforms.
Finance records are a good place to find the ones IT does not know about. Card statements and supplier payments often reveal subscriptions taken out by individual teams. Ask department heads too: they know which outside firms their people work with every day.
Tier the list
Not every supplier deserves the same attention. Sort the register into three groups: critical suppliers whose failure or breach would seriously harm the business, important ones that hold sensitive data or have meaningful access, and the rest. Most organisations find that a dozen or so suppliers sit in the top group, and those are where effort should go first.
Ask standard questions
Check their security practices and incident handling. The aim is not to audit every supplier in depth but to ask the same core questions of each, so answers can be compared and gaps spotted. A short questionnaire, sent before contracts are signed and refreshed every year or two for critical suppliers, covers most of what matters.
- Which of our data will you hold, where will it be stored and who on your side can see it?
- How do you control access for your own staff, and do you use multi-factor authentication throughout?
- Which subcontractors or cloud providers do you rely on to deliver the service?
- How do you keep systems updated, and how quickly do you apply security fixes?
- Do you hold an independent certification or assurance report, and can we see it?
- How and how quickly will you tell us about an incident that affects our data or service?
- How do you back up our data, and how long would it take to restore the service after a failure?
- What happens to our data when the contract ends?
Read the answers with the business owner of the relationship, not only IT. A vague answer on incident notification matters more for a payroll provider than for a stationery supplier. Where an answer is weak, decide whether to accept it, ask for an improvement or reduce what the supplier can reach.
Certifications help, but read the scope
An independent certificate or assurance report is useful evidence, but check what it covers. A certificate for one data centre or one product line may not include the service you are actually buying.
Limit and review access
Give only what is needed and review it regularly. Supplier access tends to grow quietly. A contractor is given administrator rights to fix one problem and keeps them for years. An integration is set up with broad permissions because it was quicker. A former agency still has a login to the website.
- Give each supplier named accounts rather than shared logins, so activity can be traced to a person.
- Grant the narrowest permissions that let them do the job, and time-limit access for one-off work.
- Require multi-factor authentication for every external account.
- Share only the data the service needs; mask or remove personal data from test and support copies where possible.
- Review supplier accounts at least twice a year for critical suppliers, and remove access the day a contract ends.
Consider a typical manufacturer that uses an outside firm to support its production systems. Rather than leaving a permanent remote connection open, it switches the connection on when a support ticket is raised and off when the ticket closes, and records each session. The supplier can still do its job quickly, and the open door no longer exists for the rest of the year.
Put it in the contract
Good intentions on both sides are not enough when something goes wrong. For critical and important suppliers, the contract should state the security commitments you rely on: how quickly they will notify you of an incident, your right to ask for evidence of their controls, limits on using subcontractors without telling you, and how your data will be returned or deleted at the end.
Most suppliers have standard terms, and smaller customers have limited room to negotiate. Even so, it is worth asking. Where terms cannot change, record the gap in your register so the business has knowingly accepted the risk rather than discovered it later.
Plan for the supplier’s bad day
Assume that at some point a critical supplier will suffer an incident. The question is how quickly you will know and what you will do. For each critical supplier, agree a named contact on both sides and note it in your incident plan. Decide in advance how you would keep operating if the service were unavailable for a day or a week, and whether you hold your own copy of the data you would need.
When an incident does happen, act on your side as well as theirs: reset credentials the supplier held, check logs for unusual activity from their accounts and tell your own customers if their data may be affected. A short rehearsal once a year, walking through a supplier breach scenario with the relevant managers, will show where the plan is thin.
Where to start
Build the register this month, using finance records and a quick question to each department head. Pick the ten or so suppliers that matter most and send them the standard questions. While you wait for answers, review their accounts and remove access nobody can explain. That is a few weeks of effort, and it puts most of your third-party risk in view and under control.
Source: Intelliversal analysis.
