Vendor and supply chain risk

Your security includes theirs

Modern businesses depend on outside providers for almost everything: accounting software, payroll, cloud storage, remote IT support, marketing platforms and industry applications. Each one either holds your data, connects to your systems or both. When a vendor is breached, attackers may gain access to its customers too. Several widely reported incidents have started with a compromised software update or a remote management tool used by a service provider.

You cannot control how a vendor runs its business, but you can choose vendors carefully, limit what they can reach and plan for the day one of them has a problem. Vendor risk management is simply a structured way of doing those three things. It does not need to be elaborate to be effective, and it scales with the size of your business.

Build a vendor inventory

List every vendor that stores your data, connects to your network or has accounts in your systems. For each, note what data they hold, what access they have, who in your business owns the relationship and when the contract renews. Include small items such as a website developer with admin access or a contractor who connects remotely to one machine.

Rank vendors by risk. A payroll provider holding staff banking details, or an IT provider with administrator access to every computer, deserves more attention than a newsletter tool with a list of email addresses. Focus your effort where the impact of a breach would be greatest. Two or three tiers are usually enough.

Ask the right questions

For higher-risk vendors, ask a short set of questions before signing and at renewal. You do not need a hundred-item questionnaire. A handful of clear questions reveals a great deal, and the quality of the answers is often as telling as the content. Where vendors have independent audit reports, such as SOC 2 or ISO 27001, ask for them and read the summary.

Review contracts for breach notification timelines, data location, data return at the end of the contract and limits on subcontracting. If personal information is involved, your obligations under Alberta's Personal Information Protection Act or PIPEDA still apply when a vendor processes it for you. Your legal advisor can help with key contracts.

• Do you require MFA for all staff accessing our data?
• Where is our data stored and backed up?
• How quickly will you tell us about a breach?
• Who at your company can access our systems?
• Do you have independent security audits?

Limit and monitor access

Give vendors the least access they need. Use named accounts for each vendor employee rather than a shared login, require MFA, and restrict remote access to specific systems and, where possible, specific times. Remove access promptly when a project ends. In Microsoft 365, review guest accounts and third-party application permissions regularly, because these accumulate quietly.

Watch for unexpected changes in vendor behaviour, such as a request to change payment details or a new person asking for access. Verify through a known contact before acting. Vendor email compromise is a common route for invoice fraud. Use a phone number from your own records, never one supplied in the suspicious message itself.

Plan for a vendor incident

Ask yourself what you would do if a critical vendor were unavailable for a week, or announced that your data had been exposed. Keep contact details for each key vendor outside their own systems, know how to revoke their access quickly and know where you would get a copy of your data.

Include a vendor scenario in your next tabletop exercise. Working through it in advance often reveals single points of failure, such as one person who knows how to reach the vendor, or a system with no export option. Fixing those before an incident is far easier than during one. Even a short discussion with your key staff is worthwhile.