How to assess and gain confidence in your supply chain cyber security

Here are some categories that you should consider including within your standard control set:

• Access Control What information and assets could suppliers have access to, and what level of access is provided (in particular privileged account access)? What policy exists for control of remote access to networks and systems?
• Application Development and Support Does the supplier have a documented SDLC (software development life cycle) process which provides assurance about the development and support for products and services?
• Business Continuity and Disaster Recovery Does the supplier have a defined and regularly tested process for IT Business Continuity and Corporate Disaster recovery?
• Change Management Are methods in place to control how changes are authorised, tested and securely deployed by authorised personnel?
• Data and Information Security Is the supplier able to describe security measures in place for mobile devices, use of personal devices, data loss prevention, security monitoring, erasure and disposal, protection of data in transit and at rest?
• Governance and Policy Does the supplier have a strong security policy for management of IT equipment, covering employee responsibilities, access to information assets and user account / password management, and management of removable media?
• Incident Management Does a defined and implemented policy including detection, resolution and recovery exist?
• Independent Testing and Assurance Is the supplier able to describe what independent testing is carried out on corporate environments, critical security controls, and in underpinning product assurance?
• Monitoring Is monitoring in place to assess access to privileged accounts and services, networks, authorised software, data loss prevention and regular log management?
• Personnel Security Does the supplier provide training on information security and vetting of staff? Do roles exist for dedicated information security staff to set and enforce standards?
• Physical Security Is the supplier able to describe how physical security is implemented to protect corporate premises and sensitive areas?
• Remote Connectivity Is the supplier able to describe how they secure and encrypt any remote connections to your network?
• Supply Chain Management How well are the information security risks within the wider supply chain managed? Does the supplier risk manage its own supply chain?
• Vulnerability Management and Patching Are processes in place to be informed of vulnerabilities present within equipment and software, along with a timely and secure patching policy used to remedy?

Other considerations that may influence your expectations could be:

• The nature of your sector or industry For example, regulatory requirements (such as GDPR), or tolerance levels for a safety critical industry may apply.
• Existing organisational standards and frameworks You may wish your suppliers to adopt the same or similar standards for cyber security frameworks as your organisation. For example, if your organisation already uses ISO 27001, it may want suppliers to use the same or demonstrate equivalency. Consideration about the possible threats to your organisation might supersede existing standards, you do not have to place reliance on them and can adapt them to use to best advantage. It should be noted that compliance against standards and frameworks does not necessarily provide security.
• Size of the supplying organisation If the supplier is small, it may be pragmatic to accept that what they have in place might be different to controls in a much larger organisation. This could be considered in conjunction with the risk levels of the acquisition to tailor the control set accordingly.

You may require your supplier to follow similar or equivalent standards to your own organisation, or you may operate in a regulated field which requires specific practices to be followed. Some common standards, certifications and regulations are listed below:

There are several ways to assess your supplier’s cyber security standards. The approach taken is likely to be constrained by how much time and resource you have available to carry out an assessment. For most organisations, a combination of techniques should be considered to allow the cross section of suppliers to be assessed.

A holistic view of the supplier should be established, including:

• where it operates from (and what laws and regulations apply in that region)
• where research and development work is carried out
• where data is held
• whether nation states have any influence on the supplier

The following table summarises common methods to assess a supplier's cyber security standards.

Assessing your suppliers comes at a cost, so you need to consider:
 

• What is their security profile? Clearly, you should spend more time monitoring suppliers that pose a higher risk to your organisation.
• Does the ability to audit the supplier exist within the contract? For example, is the supplier required to inform you if a significant change has occurred, or if there has been a breach?
• What type of assessment is required (on site, verbal, form-based, outsourced)? This will consume your resources, and your supplier will need time to respond to any assessments. If resources are limited, this will restrict how often you can assess your suppliers.

1. Communicate requirements as early as possible.

If you are establishing a new supplier relationship, let them know in advance what your standard minimum security requirements are, and how they vary for contracts at different risk levels. This can be shared as early as the Invitation to Tender. Many organisations even publish these on their websites or on other communication channels specifically shared with suppliers.

If you are introducing new security requirements to existing suppliers, explain why you are making the change and what this will mean for suppliers from this point. Give them plenty of notice before implementing the changes and allow opportunities to seek clarifications.

2. Seek evidence from your suppliers.

Ask for evidence to check that suppliers are compliant with your cyber security requirements, rather than taking their word for it. Evidence-based assurance should be maintained throughout the contract duration and not just at onboarding stage.​ This can be achieved in several ways, as described in Step 4 above.

3. Mandate compliance of minimum cyber security requirements in your supplier contracts.

Stipulating your requirements into your supplier contract formalises the supplier’s responsibility to meet cyber security requirements. The contract should also define requirements to subcontractors, and penalties if said requirements are not met or complied with. This achieves two things:

• it deters immediate suppliers from breaching contract
• it places responsibility on the immediate supplier to ensure their suppliers also adhere to the same requirements

Have a discussion with the potential suppliers to show them where they have not met your requirements. Make recommendations on what they need to do to improve their cyber risk position, and discuss if this is possible in the given timeframe. Create a security management plan that defines the controls that the supplier will need to have in place within a specified schedule. This may include:

• controls met and not met
• actions required to resolve
• timescales
• last assessment date
• next assessment date
• assessment type (for example site visit, questionnaire, pen test)
• assessment outcome

Common arrangements that are put into the contracts include:

• Ensuring that any subcontractors employed by the supplier conduct the same levels of cyber security protection as per the supplier itself. This may include restrictions on organisations or regions that may be subcontracted to, or where data is held and notification in the case a subcontractor changes.
• Incident management response and notification timeframes for responding to a breach, along with provision of support to the organisation to find the root cause.
• Staff clearances expected and due diligence to be conducted, possibly organisational approval as to which supplier personnel have access to the systems.
• Ability to audit your supplier and expected frequency of audits.
• Whether insurance for cyber security incidents is required.
• Disclosure of previous component vulnerabilities, cyber incidents or data breaches.
• General cyber security controls to be adhered to (levels of encryption required, end user devices allowed, data destruction, identity and audit controls).
• Agreement for length of time the equipment will be supported and maintained to avoid equipment falling out of support.
• Data management including what information can be passed onto a third party supplier. Only necessary data may be transferred out of the organisational network and must be protected via authentication and encryption. Will data be segregated if held on a supplier platform?
• Ability to invoke a break clause in the contract if the supplier security does not meet expected standards.
• Any other stipulations that clearly define the organisation’s and supplier’s responsibilities in cyber assurance activities.