How to assess and gain confidence in your supply chain cyber security
Page 1 of 29
This guidance describes practical steps to help organisations better assess cyber security in their supply chains. It’s aimed at medium to large organisations who need to gain confidence or assurance that mitigations are in place for vulnerabilities associated with working with suppliers.
More specifically, this guidance:
- describes typical supplier relationships, and ways that organisations are exposed to vulnerabilities and cyber attacks via the supply chain
- defines expected outcomes and key steps to help you assess your supply chain’s approach to cyber security
- answers common questions you may encounter as you work through the guidance
- supplements the NCSC’s Supply Chain Principles (published in 2020) which is referenced throughout
Note:
For guidance about how to implement cyber security with your own organisation, please refer to the NCSC’s 10 Steps to Cyber Security guidance. Smaller organisations should refer to our Cyber Action Toolkit.
Who is this guidance for?
The guidance is aimed at procurement specialists, risk managers and cyber security professionals wanting to establish (or improve) an approach for assessing the cyber security of their organisation’s supply chain. It can be applied ‘from scratch’, or can build upon any existing risk management techniques and approaches that you may have in use.
- It’s suitable for medium to larger enterprises working in both commercial and public sectors.
- Organisations with complex supply chains requiring multi-year procurement activity will already have an established process in place to secure their supply chain.
This guidance was created in conjunction with the cross market operational resilience group (cmorg) which supports the improvement of the operational resilience of the financial sector through public-private collective action.
