Think of the supply chain in the context of producing bread. It starts with the farmer supplying the grain to the mill, who grinds it down to flour and in turn supplies the flour to the bakery. To make bread, the bakery uses the flour along with other ingredients in other supply chains such as sugar, salt, yeast, etc. Together, these all work in a supply chain to create the bread. Now, when we talk of an IT supply chain, the upstream suppliers can be cloud service providers, software vendors, even consulting firms and contractors, all working to supply your business to manufacture your product.

If a farmer provides a batch of grain contaminated with Salmonella, there is now a risk of poisoning the bakery customers, not due to the bakery’s fault, but a failure in the supply chain. Compare this to an IT supply chain, there could be malware introduced into software from a vendor, or a consultant working on your business systems could be a rogue agent with malicious intent. You the manufacturer are not deliberately allowing this to happen, yet a poisoned IT supply chain could impact your business and customers.

Similarly, your business may impact other businesses and customers downstream. Your business is part of someone else’s supply chain, and they should be expecting the same due diligence from you as you expect from your suppliers. This would then be the lifecycle of supply chain risk management in IT.

• Introduction of compromised applications, systems or code into your environment due to poor coding practices and weak testing for security controls prior to production release.
• Third-party service providers with access to your IT environment who do not adequately maintain their security levels resulting in their environments being breached or their user accounts, who have access to your systems, being breached.

Before you expect your suppliers to tighten their security, your company will need to set the minimum requirements for cyber that you expect from your suppliers. Naturally, this should be a subset of the existing controls that are used in your company’s cyber program.

If your company does not maintain a sound cyber program with a baseline of controls, you cannot expect your suppliers to do the same.

Companies need to do their due diligence and not just rely on what is said. Develop a control assessment questionnaire that can be sent to suppliers to gauge their security controls. If the supplier is ISO 27001 or SOC2 type II certified, then you can rely on those certifications. If not, your team will need to evaluate the responses to the control questionnaire to identify:

• Are any controls weak that would introduce risk?
• Will the supplier be able to address those gaps adequately?
• Can your organization provide compensating controls to mitigate the risk?
• Should a decision be made to change suppliers based on unacceptable levels of risk?

As you move forward with new contracts, consider adding basic security control language into the contracts to enforce your requirements.

While many companies won’t allow a right-to-audit clause, there is a case for you to send the security control questionnaire to the suppliers annually and have them attest to their stated controls. This puts the onus on them to maintain the controls they state are in place.

As you move forward with new contracts, consider adding basic security control language into the contracts to enforce your requirements.

Companies that do not adequately prepare for an incident typically suffer far greater impacts. As an organization, you should:

• Ensure you have a cyber incident response plan.
• Ensure your suppliers and vendors are obligated to notify you immediately of a breach on their side.
• Have the ability to rapidly isolate the interaction between the third party and your organization.
• Test your incident response plans annually and include key suppliers/vendors in the testing.

Securing a supply chain requires vigilance and preparation as part of the overall cyber program. Building a strong defence is about securing every link in the chain to create a resilient barrier.