Supplier risk assessment: Cyber security questions to ask your supply chain

One of the most effective ways to ensure good supply chain security management is by conducting a cyber security questionnaire whilst onboarding new vendors. This practice is crucial for several reasons. 

Over the last decade, the traditional cybersecurity approach has seen a gradual but colossal overhaul. Cybersecurity used to be about protecting your company’s four walls. This was commonly known as the ‘castle and moat’ approach, whereby companies built up their cyber security defences to stop malicious actors from getting into their infrastructure, and then trusted everyone inside. Given this, the castle and moat approach has run its course and organisations are adopting new cybersecurity models. Zero trust is an increasingly common model which, at its simplest, can be summed up in the phrase: “Trust no one, verify everyone.”

However, as cloud-based services have become cheaper and easier to manage, this approach is no longer suitable for supplier security. For one, the traditional castle is now obsolete. With more people working remotely, and data being stored in the cloud, protection must expand beyond the traditional four walls. In addition to this, though, companies are increasingly interoperating. 

What is a supply chain attack?

A supply chain attack, also known as a third-party attack, is a type of cyberattack that targets less secure elements within an organisation’s supply chain network to compromise the entire system. These attacks take advantage of modern supply chains, where multiple vendors, suppliers, and service providers integrate their systems and data with a primary organisation. To learn more and read about real-life examples of this type of threat, you can read more in our notable supply chain attacks blog.

In both the consumer and business worlds, digitalisation has instilled greater expectations around agility, flexibility and resilience. To meet these expectations, companies have had to start relying more on each other. In the physical world, this takes the form of outsourcing to warehouses and logistics providers. When it comes to digital supply chains, companies are taking advantage of outsourcing services including payroll, data storage, cloud-based software and IT management.

In doing so, more and more data are being shared between organisations, and the digital connections between them are stronger than ever. If you think of your own company, chances are you will have several suppliers. These could provide payroll solutions, customer relationship management solutions, or even cloud storage services. Because supply chains are now more integrated, if just one of your partners is breached, then you could be too.  

It could happen to your organisation

This isn’t just a theoretical occurrence either. You will undoubtedly have heard of the IT management software provider, Kaseya, who suffered a ransomware attack in 2021 – and so did thousands of its clients. For malicious attackers, supply chain attacks are lucrative and attractive. Rather than just stealing data from one company, they could access multiple organisations following the first initial attack.  

No matter how large or small your business is, if one of your suppliers is breached, you could be impacted – it’s important to understand whether your organisation is vulnerable to a supply chain attack. To make matters more complex, you need to bear in mind that, in the same way that your company has a supply chain, so too does your supplier. Essentially, companies are becoming a digital web of data links and connections. If a hacker gets into that web, the scale of damage could be huge.  

This growing threat makes supply chain security an imperative for organisations of all shapes and sizes. The picture isn’t all doom and gloom either. Supply chain cyber security isn’t just about limiting damage, it’s also about boosting brand perception. If your company can assure partners and clients that your supply chain is managed effectively, then you can build trust and improve relationships. 

Moreover, adhering to standards like ISO 27001 supply chain management is essential for establishing a baseline of security requirements. This standard provides a framework for managing information security and helps in systematically evaluating your suppliers’ security postures. Understanding what a supply chain attack entails and incorporating specific queries in the questionnaire can reveal how prepared a supplier is against such threats.

Define your risk tolerance

The first step in any supply chain security programme is to create a map of what your supply chain looks like. From there, you should assess the importance of each supplier to your operations. It’s also vital to think about the potential risks of each supplier. For example, if your supplier processes sensitive company data, then they are likely high-risk to your organisation.

In line with assessing the risks, you should also think about the criteria that would make you feel comfortable to carry on your relationship with your supplier(s). This may include them meeting certain accreditations (see our guide to cyber essentials here), conducting regular penetration testing and using certain solutions to protect sensitive data.

To help you understand more about how to assess these risks, and define working relationship criteria, we recommend you read our Supply Chain Security guide, which gives a detailed overview of best practices for working with suppliers.

The importance of supply chain security questionnaires

The good news is, that supply chain security risk management becomes significantly more effective when organisations assess their vendors’ cybersecurity practices. How to do this? As you can guess from the title of this blog, a comprehensive cybersecurity questionnaire helps identify potential vulnerabilities within the supply chain, allowing for proactive measures to be taken. 

You may have a cybersecurity expert in-house who can conduct such questionnaires and someone to ensure the policies and procedures around onboarding are followed, however, if you don’t, we recommend engaging with supply chain cyber security consultants. Using an outsourced supply chain security advisor can enhance the effectiveness of these questionnaires.

Conduct regular supply chain assessments

Your cybersecurity supply chain risk management strategy should also include regular supplier cyber security audits. These audits will assess the ongoing compliance and security measures of vendors, ensuring that any changes in their operations do not introduce new risks. By embedding these audits into the supply chain cyber security risk management plan, your organisation can mitigate any new threats.

Experts in cyber supply chain security such as Evalian, can provide insights into best practices and emerging threats, ensuring that your organisation’s vendor onboarding strategies are aligned with industry standards and you are ensuring due diligence. Using our supply chain security software, SupplyIQ, with its dashboard and reporting system, organisations can view questionnaire responses, risks identified, risk severity and mitigation work in progress. By having this full visibility of your supply chain, alongside a managed service, will give you that extra peace of mind that your supply chain is being constantly monitored for risk.

The right questions to ask your supply chain

Once you’ve established what you expect from your suppliers, it’s time to check whether or not they meet your requirements by conducting a supplier security assessment. As the National Cyber Security Centre (“NCSC”) recommends, you should begin a dialogue with your suppliers to understand their security approaches.  

To help with this process, the NCSC has developed a set of supplier-focused cyber security questions, which you can use to frame your discussion. It’s important to note that these questions are not a checklist, but more a way to bring structure to a complex topic, the sections include: 

1. Security governance
2. Managing and recovering from incidents
3. Protecting their network
4. Protecting data
5. Offshoring
6. Personal data
7. Personnel security
8. Physical security
9. Independent testing and assurance
10. Other contractual considerations

The questions align with the NCSC’s 12 supply chain security principles, which we also advise reading as you approach this topic. The questions, of course, are written for broad enterprise use, meaning you may wish to tailor some of the questions, or will not find all of them relevant, depending on your company’s sector and circumstances. 

Some examples of questions from SupplyIQ’s assessment platform include:

• Does the supplier’s users require access to your systems or IT infrastructure?
• Does the suppliers’s systems require access or will be integrated to your systems or IT infrastructure?
• Will the supplier be providing cloud services?
• Does the supplier collect, process or store any data, from your company, as part of the products and/or services they provide?

As well as the NCSC’s questions, we also advise you to review NIST 800-161. This proposes an approach to supply chain cybersecurity that covers 4 stages across 3 tiers. The first two stages, ‘Frame’ and ‘Assess’, offer useful guidance that can help you to establish both your risk tolerance and the questions you need to ask.  

Evaluating the responses you receive 

Once your suppliers have answered your questions, you will then need to assess whether these answers are, first, satisfactory and, second, that they suit your levels of risk tolerance. The significance of your supplier to your business may sway your level of risk tolerance, meaning it’s unlikely you will take a blanket approach to evaluating suppliers.  

For example, factors to take into consideration should include things like whether a supplier provides a unique service, the amount of sensitive data they hold, and whether they are directly connected to your IT resources. 

Using an outsourced managed supply chain security service that includes vendor security questionnaire software such as SupplyIQ – means you can easily log in and instantly see responses, risk levels and reports as often as you want. But whatever format you use, you need to make sure that the reports are clear, concise, and easy to digest. For more information about SupplyIQ, get in touch for a demo or to find out more information on our vendor security management service.  

Make the activity cyclical  

Lastly, we advise you to revisit these questions on a regular basis. Just as your business changes over time, so too will your suppliers. So, it’s important to re-assess supplier risk profiles regularly. If your supplier undergoes a major IT change or your relationship with them changes, then you should review your current arrangements.  

We provide a range of supply chain security services and can help you streamline your onboarding process and shorten your sales cycles. Our experts use their skills and knowledge to help you manage your supply chain’s security risk as well as our in-house developed tool, SupplyIQ, to give you visibility over the risk and access to one dashboard overseeing your suppliers.

Need support with supply chain security?

With the increasing interconnection of business, managing third-party suppliers is becoming a complex and sprawling issue, opening further avenues of risk. Limited resources and availability of adequate expertise around this subject are proving to be a key challenge. If you need support and direction in managing your third-party supply chain,  call us for a no-obligation chat. 

We can provide several different solutions that can be tailored to your business to support the management of your supply chain security.