MY WORK / SUPPLY CHAIN RISK / THIRD-PARTY RISK
Supply Chain Risk: 3 Steps to Improve Vendor Visibility and Cyber Due Diligence
Supply chain risk is often underestimated because it sits across vendors, SaaS platforms, consultants and outsourced teams. Without clear visibility of who can access your systems, data or customers, third-party risk can build unnoticed. This short guide and video focus on practical steps to create that visibility and begin effective cyber due diligence.
Quick answer: Start with clarity: build a simple inventory of suppliers, tier them by risk, and put in place a repeatable due diligence + monitoring rhythm so supplier risk can be managed proactively rather than discovered during an incident.
Oct 23
Written By Karimah A
In the video I share three practical steps to gain clarity on your supply chain so you can strengthen your cyber security posture and manage third-party risk more effectively. The aim is practical: get enough visibility to understand who your third parties are, what they do, what data or systems they access, and how critical they are.
Key takeaway: Supply chain security is about clarity as much as control. The clearer your supplier inventory and ownership, the more effective your tiering, reassessments and incident response will be. Below are explicit, practical actions you can start this week.
Watch the video
This video is for organisations that want a practical, realistic approach to supply chain risk and third-party due diligence — especially where vendor visibility is poor, ownership is unclear, or risk decisions are being made without enough information.
Why supply chain risk matters in cyber security
Many organisations rely on third parties to process data, provide systems, support operations, or deliver critical services. If vendors are not visible, assessed and monitored, risk can accumulate outside the organisation with no clear owner.
Data exposure
Suppliers may process, store, transmit or access sensitive business, customer, employee, or operational data. Even small suppliers can be the weak link if they hold critical data or access.
Operational dependency
A supplier outage, breach, or service failure can affect business continuity, customer experience, or revenue. Map critical services as part of visibility work.
Access risk
Third parties may hold accounts, API access, remote access or administrator privileges. Track who has access and why.
Contractual and compliance risk
Weak supplier oversight can create gaps around incident reporting, data protection, audit evidence, and contractual obligations.
What you’ll learn
1. Understand everything you own
How to build a clearer view of vendors: review invoices, procurement records, application owners, and configuration items in your CMDB before applying controls.
Practical tip: start a single supplier inventory spreadsheet (or a simple tool) listing supplier name, primary contact, services provided, data accessed, and the internal owner. Aim to capture the highest-spend or highest-access suppliers first.
2. Tier your vendors
Assess suppliers based on the data they access, systems they support, business criticality, and the level of cyber supply chain risk they introduce.
Practical tip: use three tiers (High / Medium / Low). Put suppliers with access to sensitive data or critical services into High and require more detailed evidence or reassessment cadence.
3. Monitor continuously
Create reassessment reminders, maintain breach contacts, clarify incident reporting expectations, and strengthen ongoing third-party risk management.
Practical tip: set calendar reminders and a simple dashboard showing next reassessment date, last evidence collected, and open issues for each High-risk supplier.
4. Improve resilience over time
Stronger supply chain clarity reduces surprises, improves response readiness, supports due diligence, and strengthens governance.
Practical tip: after your first inventory and tiering round, schedule quarterly reviews for High-tier suppliers and a yearly mopping-up cycle for lower tiers.
Practical steps to start mapping suppliers (a 60–90 minute starter)
- Gather one consolidated list: pull procurement invoices, platform subscriptions, and application owners into a single spreadsheet.
- Quickly flag high-impact suppliers: mark those with access to customer data, admin access, or that support critical services.
- Assign an internal owner for each supplier entry so there is a named accountable person.
- For High-tier suppliers, request evidence of basic controls (access management, incident contact, backup) and record the date evidence was received.
- Set next-review dates: more frequent for High-tier, less for Low-tier suppliers.
- Use simple automation where possible (calendar reminders, shared docs) and iterate — visibility is incremental.
What cyber security due diligence should cover
Due diligence should be a practical, repeatable process that helps the business decide how much risk a third party introduces and what level of monitoring or contractual control is needed.
- Supplier ownership: who owns the relationship internally and who is responsible for review.
- Data access: what data the supplier can access, process, store, or transmit.
- System access: whether the supplier has access to applications, cloud platforms, integrations, APIs, or admin portals.
- Business criticality: whether the supplier supports an important process, service, revenue stream, or customer-facing activity.
- Security controls: whether the supplier can evidence basic controls such as access management, incident response, backup, and vulnerability management.
- Incident reporting: who must be contacted, how quickly the supplier must notify you, and what information they must provide.
- Review frequency: how often the supplier should be reassessed based on risk tier and business criticality.
Common supply chain risk challenges
- Manual tracking: supplier data is spread across spreadsheets, emails, invoices and owners.
- Lack of breach visibility: teams may not know quickly when a supplier has suffered an incident.
- Shadow IT: teams may use tools or suppliers without formal approval, review, or ownership.
- Unclear ownership: no single person is accountable for keeping supplier records accurate.
- Inconsistent due diligence: high-risk and low-risk suppliers may be reviewed in the same way.
- Weak reassessment rhythm: suppliers are assessed at onboarding but not reviewed as services or access change.
These challenges arise because supply chain security depends on coordination across procurement, IT, security and business teams. Clarity provides the foundation to address them.
Who this video is for
- Cyber security and risk leaders who need better visibility over vendors and suppliers.
- GRC and compliance professionals improving third-party risk management.
- Procurement and vendor management teams responsible for supplier oversight.
- Business owners handling sensitive data, outsourced services, or critical suppliers.
- Startup and scaleup teams preparing for client due diligence, audits, or enterprise deals.
Subscribe to my channel
Subscribe for weekly insights on cyber strategy, GRC, supply chain risk, third-party risk management and practical security governance.
Frequently asked questions
What is supply chain risk in cyber security?
Supply chain risk in cyber security is the risk introduced by vendors, suppliers, service providers, software platforms, consultants, and other third parties that can access systems, data, operations, or customers.
What is cyber supply chain risk?
Cyber supply chain risk is the risk that a third party, supplier, software provider, or external service could expose the organisation to security, operational, data protection, or incident response issues.
How does due diligence reduce supply chain risk?
Due diligence helps organisations understand what a supplier does, what data they access, how critical they are, what controls they have in place, and whether they need ongoing monitoring.
What should be included in third-party cyber security due diligence?
Third-party cyber security due diligence should include supplier ownership, data access, system access, service criticality, security controls, incident reporting expectations, contractual obligations, and reassessment frequency.
Why is vendor visibility important for third-party risk management?
Vendor visibility helps organisations understand who they rely on, what each supplier can access, which services are critical, and which third parties need stronger controls, monitoring, or review.
How often should suppliers be reassessed?
Suppliers should be reassessed based on risk. Higher-risk suppliers, critical service providers, and vendors with sensitive data or system access should be reviewed more frequently than low-risk suppliers.
Need help improving third-party risk management?
If your organisation needs better supplier visibility, cyber security due diligence, vendor tiering, or practical third-party risk governance, explore more of my work or book a consultation.