Third-Party Cyber Risk: A Practical Guide for Businesses

Your organisation can have strong internal controls and still be exposed through a supplier. Software providers, IT partners, accountants, payment platforms and contractors may hold data, connect to systems or perform privileged work. Third-party risk is therefore an operational issue, not just a procurement questionnaire.

Map access before assessing risk

Create a supplier register and record what each provider can access, what data it processes, whether it can disrupt a critical service and which subcontractors it uses. A small supplier with administrator access may represent more risk than a large provider with no system connection.

Checks to complete before onboarding

• Security ownership, policies and relevant certifications.
• Multifactor authentication, encryption and privileged-access controls.
• Patch, vulnerability and incident-management processes.
• Backup, recovery and business-continuity arrangements.
• Data locations, subprocessors, retention and secure deletion.
• Breach notification commitments and evidence the supplier can meet them.
• Exit support, data return and removal of remote access.

Put expectations into the contract

The agreement should define minimum controls, permitted use of data, notification times, audit or assurance rights, recovery expectations and responsibilities at termination. Requirements should be proportionate to the access and business impact.

Monitor throughout the relationship

Risk changes after procurement. Review critical suppliers at least periodically and when their service, ownership, hosting or access changes. Remove dormant accounts, rotate credentials where appropriate and monitor privileged activity. Track expiring certificates, licences and domains that could interrupt service.

Plan for supplier failure

Ask what happens if the supplier is unavailable, compromised or ceases trading. Know how to revoke access, recover data, switch providers and continue critical work. Keep your own copies of essential configuration, contracts and contact routes.

The NCSC’s supply-chain security guidance provides a useful framework for understanding and managing these dependencies.

Astley Digital can help map technical dependencies, review access and improve controls through our cyber security services and managed IT support.