Supplier Due Diligence
Adequately securing your supply chain is challenging. Vulnerabilities can occur at any point – and the implicit trust companies give to third-party vendors is ripe for exploitation by threat actors. Supply chain cyber security, at its core, is about creating a formal programme for supplier due diligence, assessing and controlling the security risks associated with using external suppliers. Click the image below to download your copy of the infographic.
Supplier Due Diligence Steps
Conduct a DPIA
If your organisation intends to embark on a new project or make changes to an existing system that involves personal data and it has the potential to cause harm to individuals, a DPIA should be carried out. A DPIA screening questionnaire should be completed, followed by a thorough DPIA, if necessary.
Define your risk tolerance
The first step in any supply chain security programme is to create a map of what your supply chain looks like. You should assess the importance of each supplier to your operations. Once you’ve established what you expect from your suppliers, you should check whether or not they meet your requirements.
Do your research
When starting the procurement process, conduct a risk assessment on each contract. This assesses cyber risk and creates a unique identifier, which can be used to reference each specific cyber risk profile. Don’t just stick with one supplier, research a few and make your decision using your risk assessment findings so you can calculate if mitigation is required.
Monitor and assess
The supply chain cybersecurity risk assessment process should not be a one-off activity and we recommend maintaining a constant watch on your supply chain. You should also plan for unexpected interruptions to the supply chain, enabling you to ensure business continuity.
Supply chain security services
Creating a supply chain cyber risk management programme does not occur overnight, but there are plenty of resources our cybersecurity experts have written to support your organisation in starting your supply chain risk management. We have written an in-depth guide on supply chain security, which is an excellent place to begin. In the meantime, bookmark our handy infographic below as a reminder of supplier due diligence steps.
Visit our Supply chain security service page to learn how we can help.
You may also find these security questions ask your supply chain helpful. If you are interested in hearing more on the importance of supply chain security for compliance purposes, and your organisation operates in critical sectors across the EU, visit our series of blogs on the topic: NIS 2 directive.
We support a vast range of industries, and have specialist experience in cybersecurity for the finance sector, healthcare, education, manufacturing, legal and construction sectors, to name a few.
Limited resources and the availability of adequate expertise around this subject are proving to be a key challenge and supplier due diligence is imperative. Call us for a no-obligation chat if you need support and direction.
