How to assess and gain confidence in your supply chain cyber security

Every employee within your supply chain can be a potential entry point for an attacker. This includes your own and your suppliers' staff . Educating them on how to recognise a cyber security threat can help create a solid first line of defence. Here are some practices you can adopt to enable this.

• Make cyber security training mandatory for onboarding employees, including supplier staff: additional information can be found in top tips for staff. Ensure those involved in assessing supply chain cyber security receive specialist training that equips them to fulfil their responsibilities.
• Ensure cyber security training is updated and repeated on a regular basis.
• Encourage a positive security culture, by stimulating discussions, conducting surveys, reviewing security incidents and near-miss reporting.
• Create a sense of shared accountability, as both organisation and supplier should play a part in ensuring that supply chain cyber risks are minimised.
• Share knowledge regarding potential threats; this might be with suppliers, for example, if your organisation is privy to information which may be of interest to them, or vice versa.
• Exchange knowledge and experience with a group of peer organisations who are subject to similar threats. 

• Be transparent — Communicate minimum security requirements from the outset before you enter into contract to set expectations with your suppliers. Many organisations publish their minimum security requirements for suppliers on their website, others choose to communicate this directly during the acquisition process. If there are changes to these requirements whilst in contract then notify your suppliers in advance so they have plenty of time to implement the necessary changes. A large organisation may be informed more quickly of common vulnerabilities and these should be shared with the supplier if applicable.
• Support suppliers to raise their cyber security standards — Approach the issue with the view that suppliers (especially niche, specialist companies) should be providing organisational assistance to improve their controls and standards. Suppliers will most likely welcome this assistance and they may find such practices are mutually beneficial.
• Get to know your suppliers — Make the most of your supplier relationships and really get to know the services and skills they have to offer and how you can help each other. Managing the supply chain should be a collaborative process between procuring organisation and supplier as both mutually benefit. Establish regular communication channels to keep in touch and have someone own one or a group of supplier relationships. This can be especially helpful in organisations with large and complex supply chains.