The UK’s National Cyber Security Centre (NCSC) has released a 29 page document entitled "How to assess and gain confidence in your supply chain cyber security". To support Procurement leaders in digesting this information, Darkbeam's Supply Chain Cyber Resilience Analysts have condensed the document into this actionable guide.
Why you should care about supply chain cyber security
Cyber security affects every area of business, not just the company's technology specialists.
In recent years, there has been a significant increase in the number of cyber attacks resulting from vulnerabilities within the supply chain. Despite this, only 13% of businesses review the risks posed by their immediate suppliers and only 7% review the risks of their wider supply chain.
Why might somebody be attacking your supply chain?
Many (but not all) cyber criminals are motivated by either financial gain or political objectives. Sometimes, your company may be caught up in a supply chain attack in which you weren't even the intended target.
The two main reasons somebody could attack your supply chain are:
- They might want to harm your organisation but your suppliers are more susceptible to cyber attacks
- They might want to harm your suppliers and you become collateral damage
Identify the key players in your organisation
Medium and large organisations often have multiple stakeholders involved most decisions. Identifying who these are is a significant step towards improving supply chain security and resilience.
Once all the of above have been identified, they will need to be informed of the process. Sharing this guide alongside some of your business-specific observations is a good introduction to the topic.
Develop an approach for assessing supply chain security
Companies’ supply chains are often expansive. In order to effectively tackle the risk cyber security poses to the Procurement process, your organisation will need to identify its ‘Crown Jewels’ - the critical suppliers with the potential to cause the most impact.
Other things to consider are:
- Is the supplier potentially connected to any governments which may be hostile?
- Is the supplier potentially connected to any companies or organisations which may be hostile?
- Would a breach via the supplier impact the business’s reputation?
- Would a breach via the supplier cause significant financial, legal, regulatory or contractual consequences?
Implementing a process for managing cyber security in the supply chain
Using answers to the questions above, suppliers can be divided into three profiles. Each of these profiles can be assigned minimum expectations which are communicated with suppliers and added as clauses to contracts.
Some examples of these clauses are:
| Low impact | Moderate impact | High impact |
| Cyber essentials scheme certification | The above plus:
|
The above plus:
|
Integrating the Supply Chain Cyber Resilience approach into new supplier relationships
The simplest place to start when implementing new processes is with new suppliers.
But before you can have the conversation with prospective companies, everyone involved in assessing suppliers must:
- Be aware of the threats posed by supplier cyber security
- Understand their role in reducing the risk
- Understand the processes you have defined
As cyber security risks and threats are constantly evolving, cyber assessments cannot be a ‘once and done’ activity. Instead, the supplier’s cyber position should be continually monitored through the lifecycle of the contract.
Integrating the Supply Chain Cyber Resilience approach into existing supplier relationships
During an ongoing contract, it can be difficult to stipulate material changes such as a new cyber security policy and the associated processes. Despite this, it is possible to make significant improvements to resilience.
- Identify existing contracts
Build a register of all suppliers that your business is working with. If this is not possible, key suppliers should be identified at minimum. - Risk assess and prioritise contracts
Refer to the assessment earlier in this document. - Support suppliers
If you find a shortfall in how existing suppliers are managing cyber risks, it might be the first time they’ve been asked to address the problem. Supporting the supplier is important - consider implementing a Security Management Plan with them. - Review contractual clauses
If the existing contract does not allow for assessments during the contract term, you will need to understand what can be achieved on a ‘best endeavours’ basis until it can be contractually binding. - Monitor supplier security performance
Cyber risks and threats evolve constantly. Ongoing monitoring is as important as the initial cyber assessment.
Reporting on Supply Chain Cyber Resilience progress
As Supply Chain Cyber Risk Management is strongly related to good governance, it is important that it is upheld and reported upon so that the practices introduced remain relevant.
One way to do this is by providing regular updates of risk levels to the Board or an internal committee. These reports might include:
