Your Suppliers Are Your Attack Surface

Organisations have spent years strengthening their own defences. Attackers have noticed, and increasingly target the suppliers, software vendors and service providers that have trusted access instead.

Yet in many organisations, third-party risk management still means a spreadsheet questionnaire sent once at onboarding and never revisited.

Tier Your Suppliers

Not every supplier deserves the same attention. Tier them by the data they access, the services they support and how hard they would be to replace. Spend your effort on the critical few.

Ask for Evidence, Not Just Answers

Self-assessment questionnaires have their place, but critical suppliers should provide evidence: certifications such as ISO 27001, independent reports such as SOC 2, penetration test summaries or the right to audit.

Write Security into Contracts

Contracts should set clear requirements for security controls, breach notification, data location, subcontracting and the return or deletion of data at exit. It is far easier to agree these before signing than after an incident.

Monitor Through the Relationship

Risk changes. Suppliers are acquired, change subcontractors or suffer incidents. Review critical suppliers periodically and set triggers, such as a breach or a change of ownership, for reassessment.

Plan for Failure

Ask what happens if a critical supplier fails or must be replaced quickly. Exit plans, alternative suppliers and data portability are part of business continuity, and regulators increasingly expect them for critical outsourcing.