Supply chain security guidance

You must protect the information you share with your suppliers from any unauthorised access, modification or deletion, which could cause disruption to your organisation and its business. 

Example

An IT contractor sold computers stolen from an aviation company which contained details of commercial and military flight plans to pay off debts.

A supplier has a legacy application that wasn't fully patched, yet hosted some sensitive information from the customer.

You should:

• Consider asking suppliers to use Cyber Essentials as the baseline level of protection. It significantly reduces vulnerabilities to the most common internet based threats (hacking and phishing1). All suppliers to government are required to demonstrate how they will achieve its five technical controls. Where this level of commitment is not realistic, the new Cyber Security Small Business Guide may provide a more achievable way for suppliers to begin to improve their resilience. 
• Where greater assurance is required and you want suppliers to be able to identify with confidence any potential attacker presence on their systems, require suppliers to understand their systems, implement security monitoring and develop an incident response capability. 
• To protect against a wider range of attacks, require suppliers to implement a holistic approach to security, following 10 Steps to Cyber Security, ISO27001 (or similar).
• Where appropriate require personnel, physical and procedural controls to protect against fraud, theft, and insider threats. All staff working on a contract should be screened, following the principles outlined by the Cabinet Office Baseline Protective Security Standard (BPSS), and additional checks (eg financial checks) added as required for the role.
• Require the implementation of ICO guidance for protecting and off-shoring personal information, where the personal information is stored, processed or handled as part of a contract.
• Where suppliers use cloud-based services, you should understand that it is not possible to transfer complete responsibility or accountability for protecting information to the provider of that service. This is true in every case. Security requirements to protect information, systems and services should be reflected in the contracts and service agreements you have in place with suppliers, and should inform the choices they make about how the cloud service is deployed and delivered. For HMG, the G-Cloud digital market place, provides a range of service offerings that can be matched against your organisation's needs. As a minimum, it is recommended that suppliers follow NCSC's cloud security principles to frame their security needs.
• Where information is held in a common data environment, whether or not this is cloud-based, it is recommended that this is reviewed using the ‘Common Data Environments guidance available on the CPNI website at https://www.cpni.gov.uk/digital-built-assets-and-environments.

1 Note that the NCSC has launched a number of new services under the Active Cyber Defence programme to improve basic cyber security. For example, Mail Check encourages the adoption of secure email protocols for the Public Sector. Anyone can register their DMARC/SPF records and they should. It may be worthwhile recommending these to your key suppliers too. 

You must ensure that the security properties or requirements needed to protect a product or service, have been effectively specified to the supplier.

Example

A supplier is building a digital service for you that will handle very sensitive information. You have poorly described your security needs and therefore the supplier has delivered something which doesn't deliver the security you need. 

You need absolute clarity about your security and functional needs. These must be described clearly and unambiguously to the supplier. If the supplier is delivering an IT system - then it must meet the security requirements that have been specified. For example, Cyber Essentials or any other needs you have set.

In addition, you should consider:

• Be aware of any known gaps in coverage of schemes like Cyber Essentials.
• Requiring additional controls to provide assurance about the product or service to be delivered. If for example, the contract relates to the development of new software tools, or the manufacturing of components, you will need to specify that the supplier follows best practice in these areas.
• In cases where a supply chain is delivering a project or asset/facilities management using collaborative digital engineering systems such mitigation methods would not be effective, further guidance is available at….https://www.cpni.gov.uk/digital-built-assets-and-environments.
• Where a Cloud service is being delivered, you should follow the guidance detailed under Use Case A above. 

You must ensure that any network connections or data-sharing with third parties does not introduce unmanaged vulnerabilities that have the potential to affect the security of your business systems.

This is a critical consideration for all contracts that include connections to a supplier's system. You will need to decide how you want the supplier to perform the work on your behalf. Will they work at your premises or theirs? How much access and connectivity they will need to carry this out?

Example

Cyber criminals attacked a large commercial company exploiting unprotected supplier connections that were used to manage the customer'senvironmental control systems. This led to significant loss of data, disruption to business and significant damage to the company's reputation.

Where a supplier's systems are connected to yours you should:

• Ensure that the accesses you provide to your systems, services, information and premises is limited, controlled and monitored. This is true for both your supplier's people and their systems. These accesses should be reviewed periodically, and removed when no longer required.
• If you intend that the supplier will perform the contracted work on your systems and premises, ensure these are appropriately segregated from the rest of your network. 10 Steps to Cyber Security, Network Security shows you how to do this.
• Access to contract-related information, contracted products or services should be limited on a 'least privilege' basis.
• Have a secure means to exchange hard and soft copy information with your supplier. For guidance on hard copy exchanges see the Cabinet Office, Government Classification Scheme and for guidance on data in transit/exchanges see 10 Steps to Cyber Security, Home and Mobile Working.
• Where organisations use operational technology as part of a system or to deliver services,  like other technology it should be treated as 'untrusted', and managed accordingly.  

You must be confident that your supply chain security can deal with attacks, and attempted subversion by state actors - but only in those circumstances where your threat model warrants it. 

Example

A security guard contracted to a defence company stole, and attempted to sell documents that detailed the electronic warfare systems used to protect UK and NATO ships, to a foreign intelligence service. 

In national security cases such as this, you will need to seek professional advice from the NCSC and CPNI, as this is beyond the scope of the guidance provided.

Matters will likely include:

• Adoption of bespoke approaches to security.
• Use of high assurance products, with improved personnel and physical security arrangements.
• Vulnerabilities that might arise in manufacturing or build processes. 
• Additional measures to protect the privacy and identity of contracting partners and their procurement activities.