Who else has access to your business? Understanding supplier cyber risk

Start with who has access to what

Think about the organisations you rely on to keep your business running.

Your IT provider might have administrative access to important systems. Your accountant may handle sensitive financial information. A software supplier could store customer records, while a website agency might manage your hosting or domain.

These are all normal business arrangements.

But they also create dependencies that need to be understood.

Start by identifying which suppliers can access your information, systems or accounts, and which services you would struggle to operate without.

You may discover that some organisations have access they no longer need, or that important services depend on a supplier nobody has reviewed for some time.

You can't manage every risk. But you can make better decisions when you understand where those risks exist.

Not all suppliers carry the same risk

A supplier delivering office stationery is unlikely to need the same level of security scrutiny as an organisation managing your customer database.

The difference is what they can access and how much your business depends on them.

Consider three things.

First, the information they hold or can access. Is it publicly available information, internal business material or sensitive customer data?

Second, their access to your systems. Can they view information, make changes or administer important services?

Third, how dependent you are on them. Would a disruption to their service prevent your business from operating normally?

These questions help you identify where more detailed checks might be appropriate.

The aim is to focus your attention on the relationships that could have the greatest impact on your organisation.

Ask the right questions

You don't necessarily need a complicated supplier questionnaire.

For important suppliers, a few sensible questions can tell you a great deal.

How do they protect access to your information and systems?

Do they use multi-factor authentication for important accounts?

Who within their organisation can access your information?

How would they tell you if they experienced a security incident that affected your business?

What arrangements do they have to recover important services following disruption?

Depending on the relationship, you might also ask whether they hold a recognised security certification, such as Cyber Essentials.

Certification can provide useful assurance about particular security controls. It shouldn't be treated as a guarantee that nothing can go wrong.

The important thing is to understand whether the supplier's arrangements are appropriate for the service they provide and the information they handle.

Make responsibilities clear

Security expectations are easier to manage when both organisations understand their responsibilities.

For important supplier relationships, this may mean agreeing who can access particular systems, how information should be protected and what happens if something goes wrong.

Contracts and service agreements can help establish those expectations.

Where a supplier processes personal data on your behalf, UK data protection requirements may also apply to how that relationship is managed.

The Information Commissioner's Office provides guidance on the responsibilities of organisations using third parties to process personal data.

For smaller businesses, the important principle is straightforward.

Don't assume that because somebody else provides a service, they automatically take responsibility for every security risk associated with it.

Understand what the supplier is responsible for and what remains your responsibility.

Review arrangements when things change

Supplier security isn't something to consider only when signing a contract.

Relationships change.

A supplier may start handling different information, introduce new technology or require additional access to your systems.

People also leave organisations, contracts end and services move elsewhere.

When those things happen, access and security arrangements should be reviewed.

If a supplier no longer needs access, remove it.

If their responsibilities change, check whether the existing protections are still appropriate.

And if a critical supplier experiences an incident, make sure you know how you will be informed and what support you can expect.

This doesn't require a complicated ongoing assurance programme.

For many smaller organisations, maintaining a clear record of important suppliers and reviewing it periodically is a sensible starting point.