Third-Party Risk Management: Could Your Suppliers Be Your Biggest Information Security Risk?

All organisations rely on third-party suppliers in one form or another.  There are clear advantages to doing so.  Cost is an obvious one, but organisations also use third parties to provide services they cannot deliver effectively themselves.  For example, you may need secure storage for documents and other assets but lack the necessary space, or you may have IT infrastructure that needs to be secured and maintained without having the specialist expertise in-house.  The challenge is deciding whether to trust a third party when much of the way it operates is not visible to you.  

Depending on the size and complexity of your organisation, one of the first useful steps is to classify third-party suppliers according to inherent risk before considering any controls or assurance evidence.  We always advise organisations that classification needs to consider more than just access to information assets: it should also reflect the sensitivity and volume of information involved, privileged or network access, service criticality, operational dependency, business continuity, use of subcontractors, processing locations, and applicable legal or regulatory obligations.

This does not need to be complex.  In our experience, one of the most effective approaches is to place each supplier into a high-, medium- or low-risk category based on the factors listed above.  For example:

• High risk: Suppliers that have direct access to your organisation’s network, possibly with the ability to make changes to the IT infrastructure or gain access to a large volume of important information assets.  Examples could include data centre hosting providers, cloud-hosted infrastructure service providers, HR service providers, managed service providers (MSPs), security operations centres (SOCs), and IT support organisations with administrative access to your systems.  
• Medium risk: Suppliers that do not have direct access to your organisation’s network but may send, receive, store, or otherwise process important information assets under your organisation’s control.  Examples in this category could include email marketing providers, external auditors, and business consultants.
• Low risk: Suppliers that do not have direct access to your organisation’s network and do not send, receive, store or otherwise process the information assets under the organisation’s control.  Examples in this category could include stationery suppliers, general office equipment suppliers, cleaning services, building maintenance contractors and utility service providers such as gas, electricity, and water.

Based on the information you store, process or communicate, you should have a good idea of the types of security controls or mechanisms needed to protect it.  For example, to protect highly confidential information such as personal information or sensitive commercial information from a breach of confidentiality, you are likely to deploy encryption, both when the information is being communicated and where it is stored.  To protect the integrity of the information, you may implement formal change processes or segregation of duties to guard against unauthorised modification.  Finally, to ensure information is available to those that need it, you would likely consider having backups (which of course themselves would need to be encrypted).  Those are just a few examples of the many controls we recommend organisations put in place to protect their important information assets.  However, to determine whether or not those controls should be deployed, you first need to understand the risk.

When considering risk, there are two component parts to be aware of.  The first is what the impact would be on your organisation if a breach of confidentiality, integrity, or availability of information assets were to occur.  Suppliers in the high-risk category have direct access to systems that contain sensitive information, such as the personal information of employees or sensitive commercial information.  They are also more likely to be the cause of an unwanted incident simply because they have the access to systems and information that organisations in the other categories do not.  Likelihood is the second component part of risk.  

It is relatively straightforward to assess the potential impact because it is your information, and your organisation would face the fines, reputational damage and loss of revenue if something went wrong.  Likelihood takes more work to understand.  You need to establish the chances of one of your suppliers causing or contributing to an unwanted incident.  The simplest way to begin is to ask them.  

It follows that the security controls that you expect suppliers to have in place would be comparable to those deployed within your own organisation.  So, based on your own security requirements and best practice information security controls as defined by frameworks such as ISO 27001, you can create a set of questions that are used to establish what each supplier’s approach to cyber security is.  

When supporting organisations in developing and deploying such questionnaires, we typically suggest that the length and depth of questionnaires should reflect the service the supplier is providing and the information or systems they will have access to.  The higher the perceived risk, the more assurance you are likely to need and therefore the more questions you will need to ask.  Some questions may be high level, such as:

• Are you ISO 27001 certified and does the scope of your certification cover the products or services you supply to us?
• Have you met minimum standards of cyber security by passing Cyber Essentials or Cyber Essentials Plus?
• Do you have an information security policy in place that is read and acknowledged by all staff?
• Do you sub-contract any part of the service you provide to us?

Others could be more specific or technical in nature and again, would depend on the nature of the product or service being delivered.  These could include:

• Is data encrypted at rest within your systems? If so, what cryptographic technology is in use and what are the typical key lengths?
• Is anti-malware technology deployed across your estate? If so, what is it and does it prevent infection as well as detect and report?
• Do you log the activity of users across your infrastructure such that the logs could be used during an incident investigation?

Suppliers in the high-risk category will generally need to receive larger, more complex questionnaires, with fewer questions asked of suppliers in the lower categories.  It should also be noted that this is not a one-off project, but part of ongoing supplier risk management and will therefore be repeated on an iterative basis.  

Suppliers in the high-risk category will likely need to complete the questionnaire on an annual basis.  It is also important to note that, in our experience, ISO 27001 or Cyber Essentials certification by themselves will not be enough for these suppliers, as there will be specific security controls that your organisation requires the supplier to implement that may not be covered sufficiently in either of those standards.  

For suppliers in the medium risk category, questionnaire completion once every 2 years is likely to be more appropriate, while low-risk suppliers may only need to complete it when their contract is renewed.  For suppliers in these categories, URM often finds that evidence of ISO 27001 certification or Cyber Essentials certification, together with assurance over a small number of other general controls, provides the necessary level of security assurance.

There are of course other ways to gain assurance about a supplier.  In practice, this may involve speaking to organisations that have worked with it, asking about their experience and researching whether the supplier has previously been involved in any security incidents.  

The supplier risk questionnaire should first be deployed as part of the procurement process so that you can make an informed decision about which organisations to work with.  An organisation that has invested the time and effort to become ISO 27001 or Cyber Essentials Plus certified may be a better proposition from a risk perspective than an organisation that has not.  This leads us on to the next element of supply chain risk management, which is contractual agreements.

‍

To help ensure that important information assets are not compromised by a third party, you need the supplier to agree to implement the security controls that you require.  This is achieved using the contract.  We always strongly advise our clients that each supplier agreement or contract should stipulate what controls need to be implemented, under what circumstances and who is responsible for implementing them (the organisation or the supplier).  The specific controls mentioned above are just a few of the ones that should be included in the contract and again, the controls required will differ between suppliers depending on the products or services they are supplying.  However, they could include a requirement to maintain an information security management system (ISMS) based on ISO 27001 and to apply appropriate access controls, use of encryption, malware protection and vulnerability management, or to provide evidence on an annual basis that they have maintained their Cyber Essentials or Cyber Essentials Plus certification.  Other requirements could include the need for background screening for staff and ongoing cyber security awareness training.  

In addition, the contract or agreement may include rules governing how information may be used, how it must be segregated from other customers’ information, and how the supplier will comply with relevant legislation and regulations such as the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.  It may also set requirements for incident management, including the need to notify the customer of any security breach within a specified period.

In addition, it’s important that your information assets can no longer be part of any compromise of a supplier’s systems after your agreement with them comes to an end.  As such, requirements should also be in place in the contract to ensure that your information assets are returned or destroyed.  A process is needed to ensure that this happens as part of supplier offboarding.  Offboarding should also include revoking all physical and logical access, with supplier accounts being disabled.  

Finally, a supplier contract should always include a right to audit the supplier. If the supplier refuses to grant this right, it could be a reason to look elsewhere, depending on the supplier, although some organisations, such as large cloud service providers, may provide assurance in other ways.

In our experience, contractual security requirements should extend to relevant subcontractors and other parties in the supply chain. The supplier should remain accountable for services performed by those parties and impose equivalent or appropriate obligations where they handle your organisation’s information, access its systems or support critical services.  We recommend that the contract requires disclosure of material subcontractors, notification of proposed changes and, where proportionate, prior customer approval. It should also address processing locations, assurance evidence, incident notification and the supplier’s responsibility for monitoring subcontractor compliance.

As discussed above, security-related questionnaires will generally need to be sent to suppliers on an iterative basis.  However, at URM, we often find that an annual questionnaire is not enough for high-risk suppliers.  For these suppliers, you may need a much more comprehensive understanding of the service on an ongoing basis so that you can recognise an issue early enough to control its impact.  We therefore advise clients to hold regular service review meetings with such suppliers at least quarterly, or monthly in some cases.  The agenda should cover the quality of the service and confirm that the key controls required by the contract remain in place and operate as expected.  For example, if the supplier is required to perform background screening for employees working on your contract, you would expect evidence that this has been completed for new joiners.  The meeting should also cover any incidents, control improvements and recent audit evidence relating to ISO 27001 or Cyber Essentials.

Changes to the way products or services are provided to you should also be discussed at these meetings, allowing you to maintain a clear understanding of the risks they pose.  Where such changes increase levels of risk, this might result in modifications to controls to maintain the expected level of security.

One issue we regularly encounter when working with organisations is the use of cloud services without the organisation’s knowledge.  Because these services are so easy to sign up for, individuals may start using them without going through an approval process.  If the organisation does not know which services are in use, it cannot properly assess the risks presented by those suppliers.

When advising clients on how to avoid this, we typically recommend combining staff reporting with practical discovery controls to identify unsanctioned cloud services. Sources can include procurement and expense records, software and asset inventories, identity-provider application listings, network or cloud-access log information, and periodic access reviews.  Discovered services should be assessed before use continues, and users should have a clear route for requesting approved tools so that security controls do not unnecessarily obstruct legitimate business needs.

Knowing what’s in use is the first step towards understanding the risk.  We suggest creating a register of products and services provided by third parties, including cloud-based AI systems such as ChatGPT, or cloud-based storage and communications solutions such as Dropbox.  Once you know what cloud services are in use, you can determine their risk level by understanding the nature of the information that is stored on or shared with them.  To control their use, suitable acceptable use policies should be implemented and enforced.
‍

Third-party suppliers can bring significant value to an organisation, but they can also introduce risk if they are not managed effectively.  By following the steps outlined in this blog, organisations can build trust in their supply chain while protecting their information, systems and operations.  In our 21 years of experience helping organisations strengthen their third-party and supplier information security risk management, one lesson has remained consistent: effective supplier assurance is not a one-off exercise.  It is an ongoing process that can deliver greater resilience, confidence and control as business relationships and risks evolve.