Supplier cyber risk: a practical checklist

This guide is for security teams, procurement leads, risk managers and finance directors responsible for third parties. It gives a practical checklist for understanding supplier cyber risk, setting proportionate requirements, building them into contracts and monitoring suppliers over the life of the relationship.

It draws on the NCSC's supply chain security guidance, which sets out principles in four stages: understand the risks, establish control, check your arrangements and continuous improvement. It also uses the NCSC's guidance on assessing supply chain cyber security, written for medium to large organisations in the commercial and public sectors.

#Why does supplier cyber risk matter?

Supplier cyber risk matters because suppliers can hold your data, connect to your systems or run services you cannot operate without. A compromise or outage at a supplier can quickly become your incident. The UK Cyber Governance Code of Practice asks boards to confirm that their organisation can withstand supply chain and partner cyber risks.

Under its risk management principle, the Cyber Governance Code of Practice includes an action for boards to confirm that supplier information is assessed regularly and in proportion to risk. That makes supplier risk a governance matter as well as a procurement task, and a natural part of regular board reporting.

#How do you work out which suppliers matter most?

Work out which suppliers matter most by asking three questions of each one: what data of yours do they hold, what access do they have to your systems, and which critical services depend on them? Group suppliers into tiers based on the answers, and focus your assurance effort on the top tier first.

The NCSC's assessment guidance suggests prioritising your organisation's crown jewels before designing your approach. Start from your critical services and the information that matters most, then work outwards to the suppliers they depend on. The same guidance stresses identifying the key players inside your organisation early, such as procurement, legal, security and the business owners of each supplier.

#Tiering checklist

• Build or refresh a supplier inventory, including software, cloud, IT support, payroll, outsourced services and facilities providers.
• Record what personal or sensitive data each supplier holds, sees or processes.
• Record each supplier's access: remote access, privileged accounts, integrations and network connections.
• Map suppliers to your critical services and note any single points of failure.
• Note the fourth parties your critical suppliers rely on, where you can find out.
• Give each supplier a tier, an internal owner and a review frequency.

#What should you ask suppliers about their security?

Ask suppliers questions in proportion to their tier, focused on the controls that protect your data and your access. Cover certification and its scope, access management, multi-factor authentication, patching, backups, incident notification, subcontractors and data location. For your highest-risk suppliers, ask for evidence rather than accepting answers alone.

#Core questions for higher-tier suppliers

1. Which certifications do you hold, and does their scope cover the service you provide to us?
2. How do you enforce multi-factor authentication for staff and administrators?
3. How is access to our data and systems granted, reviewed and removed?
4. How quickly do you apply critical security updates?
5. How are your backups protected and tested, and how quickly could you restore our service?
6. How, and how quickly, will you tell us about an incident affecting our data or service?
7. Which subcontractors and cloud providers support the service, and how do you gain assurance over them?
8. Where is our data stored and processed?
9. When did you last test your incident response and recovery plans?

#Lighter checks for lower-tier suppliers

• Confirm what data of yours, if any, they hold, and whether they have any access to your systems.
• Ask for a current certificate, such as Cyber Essentials, where one exists.
• Agree who to contact, and how, if either side has an incident.
• Check that contract terms cover data protection and the return or deletion of your data.

For cloud and software-as-a-service providers, clarify which security settings the provider manages and which you must configure yourself, such as user access, multi-factor authentication and data sharing. Misunderstanding that split can leave gaps that neither side is watching.

Certifications are useful evidence, but they need checking. IASME states that Cyber Essentials certification is valid for 12 months, so confirm the certificate date and whether it covers the whole organisation or a defined part. For ISO/IEC 27001, ISO describes certification as one way to demonstrate that an organisation can manage information securely. Ask for the certificate and its scope, and check which certification body issued it.

#What should supplier contracts include?

Supplier contracts should include security requirements in proportion to the supplier's tier, a duty to tell you promptly about incidents, rights to request assurance, controls on subcontracting, data handling, return and deletion terms, and exit arrangements. The NCSC recommends embedding cyber security controls throughout the life of the contract, not only at signature.

• Security requirements: minimum controls or certifications, linked to the supplier's tier.
• Incident notification: a defined timescale, a contact route and cooperation during investigations.
• Assurance rights: the right to request evidence, questionnaires or audits.
• Subcontracting: notice of, or approval for, new subcontractors who will handle your data.
• Data protection: where data is held, and how it is returned or deleted when the contract ends.
• Access: how supplier access to your systems is granted, logged and removed.
• Exit: how the service would be transferred or wound down safely.

For existing contracts, the NCSC's guidance suggests identifying them, risk-assessing and prioritising them, supporting your suppliers to improve, and reviewing contractual clauses. Renewal and re-tendering are natural points to add stronger terms.

#How do you monitor suppliers after onboarding?

Monitor suppliers by reviewing them at a frequency set by their tier, tracking certificate expiry dates, following up agreed improvements and watching for incidents or changes to their service. The NCSC recommends monitoring supplier security performance and reporting progress to the board. Supplier risk changes over time, so assurance needs to be ongoing.

• Diary certificate expiry dates and request renewed certificates on time.
• Repeat questionnaires or reviews at the frequency set for each tier.
• Review supplier access regularly and remove anything no longer needed.
• Track remediation actions agreed with suppliers until they are closed.
• Trigger an extra review after a supplier incident, a change of ownership or a significant change to the service.
• Include critical suppliers in your incident exercises where you can.
• Report material supplier risks to the board through your normal cyber reporting.

#What should you do when a supplier has a cyber incident?

When a supplier has a cyber incident, find out quickly whether your data, access or services are affected, and treat it as a potential incident of your own. Restrict or suspend the supplier's access if needed, activate your incident plan, check your own notification duties and record your decisions. Contract terms agreed in advance make this far easier.

• Ask the supplier what happened, which data and services are affected and what it is doing to contain the incident.
• Review and, if necessary, suspend the supplier's accounts, access and integrations with your systems.
• Look for related activity in your own environment, such as unusual sign-ins from supplier accounts.
• Assess whether personal data you are responsible for is involved, and whether you have reporting duties of your own.
• Prepare to run critical services without the supplier, using your continuity plans.
• Record what you were told, when and by whom, and agree a schedule for updates.

#What to do next

Next, build or refresh your supplier inventory, tier suppliers by data, access and criticality, and start with your top tier. Send proportionate questions, check certificates and their scope, and strengthen contract terms at the next opportunity. Then set a review rhythm and report supplier risk to the board alongside your other cyber risks.

1. Agree an owner for supplier cyber risk and a simple tiering method.
2. Tier your existing suppliers, starting with those linked to critical services.
3. Issue proportionate questions and collect evidence from the top tier.
4. Add security clauses to contract templates and to upcoming renewals.
5. Set review frequencies and track certificate dates.
6. Work with key suppliers on improvements, rather than treating assurance as a one-off test.

The NCSC's assessment guidance encourages organisations to collaborate with their suppliers and to keep evaluating their approach as threats evolve. Supplier assurance works best as a continuing relationship, not an annual form.

#Frequently asked questions