Supply chain attacks give threat actors a route into organisations through the suppliers and service providers they trust. This is a central challenge of third party risk management (TPRM): organisations inherit risks from businesses they do not control, and those risks can remain hidden without a coordinated effort to identify, assess and manage them.
Attackers can reach many organisations through one supplier
Cloud providers, managed services and specialist vendors give organisations access to the technology and expertise they need to operate and grow. But these providers also rely on other businesses to deliver their services, adding further layers of software, infrastructure and data handling to the relationship. These fourth and fifth party dependencies can leave security teams with only a partial view of the supply chain and the risks it introduces.
The 2020 SolarWinds compromise demonstrates the scale of this risk. Attackers inserted malicious code into updates for Orion, an IT monitoring platform, and used the trusted update process to distribute it to customers. SolarWinds reported up to 18,000 customer downloads of affected versions, later estimating that fewer than 100 customers were hacked through the malicious code.
For attackers, the attraction is clear. Compromising one supplier can open access to multiple customers, including organisations whose own systems are harder to breach directly. Each additional provider can widen that exposure, even when the organisation has no direct relationship with it.
The gaps that leave third party risk unmanaged
Three gaps can leave organisations exposed after a supplier has been approved:
- Outdated risk ratings: Risk ratings are carried forward without reassessment, even when a supplier takes on more sensitive information, broader system access or greater responsibility for critical services.
- Undisclosed changes: Changes to technology, subcontractors or data handling are not reported to the teams responsible for assessing and managing supplier risk.
- Unresolved findings: Assessments identify weaknesses, but no one is accountable for resolving them or checking that agreed improvements have been made.
Outdated assessments can create a false sense of assurance
The adoption of artificial intelligence (AI) is a clear example of how supplier risk can change without a new contract. A provider may begin using an AI service to process customer records, introducing another organisation into the data flow. The commercial relationship may be unchanged, but the data handling arrangements and risks are different.
That change needs to be assessed in context: what information is shared with the AI service? Can it be retained or used to train models? Do existing controls address the new exposure? The findings may justify a higher risk tier, stronger controls or more frequent assurance. Without periodic reviews and requirements to disclose material changes, this exposure can go unnoticed.
What effective TPRM actually looks like
Effective TPRM depends on procurement, legal, security and business teams working from the same understanding of risk. Assessments should lead to clear decisions about the controls and assurance each relationship requires:
- Proportionate assessments: Tier suppliers by the sensitivity of information they handle, their system access and the criticality of the services they support. Set assessment depth and review frequency accordingly.
- Evidence validation: Confirm that certifications, audit reports and other evidence cover the service being assessed. Assign findings to an owner, agree remediation timeframes and check that weaknesses have been addressed.
- Ongoing monitoring and reassessment: Combine periodic reviews with defined triggers for reassessment, including material changes to services, technology, access and subcontractors. Update risk tiers and security requirements to reflect the findings.
- Incident preparedness: Agree notification requirements, response responsibilities and authority to restrict supplier access. Exercise these arrangements, including how critical business activities would continue if a provider became unavailable.
How Meridian Cyber can help
At Meridian Cyber, we help organisations establish and mature third party risk management capabilities across the supplier lifecycle. Our third party risk services include:
- Third party risk register: A central record of supplier criticality, system access, data exposure and assurance status to support ongoing review and reporting.
- Vendor due diligence assessment: Assessment of supplier security controls and supporting evidence, with recommendations for remediation and risk treatment.
- Contract security requirements: Requirements covering access control, data protection, incident notification, audit rights, subcontracting and service continuity.
- Third party risk management policy: Defined supplier risk tiers, due diligence and assurance requirements, escalation criteria and accountabilities throughout the relationship.
- Vendor onboarding and offboarding checklist: Security checks for granting and withdrawing access, managing data and meeting contractual obligations at the start and end of an engagement.
- Vendor incident response runbook: Notification triggers, evidence requirements and response responsibilities to coordinate action between your organisation and the supplier.
We work with your teams to put these requirements into practice and maintain assurance as suppliers, services and dependencies change.
To learn how we can help your organisation manage third party cyber risk, contact our team.