Your Suppliers Are Part of Your Attack Surface: Managing Third-Party Risk in the NIS2 Era

94 Views

Ask most IT leaders where their biggest security risk sits and they will point to their own systems: unpatched servers, weak passwords, staff clicking on phishing links. Ask where the last serious incident in their sector started, though, and the answer is often somewhere else entirely, at a software vendor, a managed service provider or a logistics partner with access to the network.

Modern IT supply chains are long. A typical mid-sized company relies on dozens of SaaS platforms, a hosting provider, a managed IT partner and a handful of specialist contractors, each with some level of access to data or systems. Every one of those relationships is a possible way in.

Regulators have noticed. NIS2 explicitly lists supply chain security among the risk management measures that in-scope organisations must take, and DORA sets detailed rules for how financial firms oversee their ICT providers. Keeping track of all this in spreadsheets is becoming hard to defend, which is why many firms now use Copla’s vendor risk management software or comparable tools to run questionnaires, due diligence and monitoring in one place.

Start with an honest inventory

Most organisations underestimate how many suppliers they have. Procurement records capture the big contracts, but free trials that became paid tools, browser extensions and departmental software often slip through.

A useful first step is to pull together every supplier that stores company data, connects to company systems or provides a service the business couldn’t run without. Finance records, single sign-on logs and expense reports are good places to find the ones nobody mentioned.

Tier suppliers by impact

Not every vendor deserves the same scrutiny. A design tool used by two people is not the same as the provider hosting your customer database. Grouping suppliers into tiers keeps the effort proportionate.

A simple approach uses three questions. What data does the supplier hold? What access does it have to internal systems? How badly would the business be affected if it went down for a week? Suppliers that score high on any of the three belong in the top tier and need the most detailed review.

Ask for evidence, not promises

Security questionnaires are only useful if the answers are backed up. For critical suppliers, ask for recent certifications such as ISO 27001, independent audit reports, penetration test summaries and details of how they handle incidents. Check that each certificate’s scope covers the specific service you use.

Contracts matter too. Make sure they include the right to be notified quickly of incidents, clear responsibilities for data protection and a realistic exit plan if the relationship ends.

Keep monitoring after onboarding

The most common gap in third-party risk management is that review stops once the contract is signed. Suppliers change ownership, move data to new regions and suffer breaches. A vendor that was low risk two years ago may not be today.

Set review dates based on tier, with critical suppliers checked at least annually. Watch for trigger events between reviews, such as a publicly reported breach, a merger or a major change in the service.

Make it a shared responsibility

Third-party risk often falls between procurement, IT and legal, with each assuming another team is handling it. Agreeing who owns each step, from initial assessment to ongoing monitoring, removes that ambiguity.

The supply chain will only get longer as businesses adopt more cloud services and AI tools. Firms that treat their suppliers as part of their own security perimeter, and manage them that way, will be in a much stronger position when the next incident starts somewhere outside their walls.