Supply chain attack: managing supplier cyber risk
A supply chain attack is a cyber attack that reaches a business through one of its suppliers or software providers. This guide is for UK businesses that depend on third-party systems. It explains how attacks happen and how to check supplier security, and how our supplier audit work helps.
By Matt Buckley · Updated
How supply chain attacks happen
- A software update from a trusted vendor is tampered with before release
- A managed service provider's remote access is used to reach its clients
- A smaller supplier with weak controls is used to send convincing invoice fraud
- Shared data held by a supplier is stolen from the supplier's systems
Why this is a procurement issue
Security teams can protect the systems they run. They cannot directly control a supplier's systems. What procurement controls is who gets onboarded, what they must commit to in contract and how they are checked over time. That is where most of the risk reduction sits.
Controls to build into sourcing
- Tier suppliers by the access and data they hold, not only by spend
- Ask for Cyber Essentials or equivalent assurance for higher-risk suppliers
- Include security, incident notification and audit clauses in contracts
- Limit supplier access to what is needed and remove it at contract end
- Verify bank detail changes by phone before paying, to stop invoice fraud
Linking cyber risk to supply chain resilience
Supplier cyber risk sits alongside financial, geographic and operational risk. The same supplier risk register should hold all of them. Our supply chain resilience guide and supplier performance guide cover the wider framework.
Where Caventis fits
Caventis is not a cyber security firm. We help businesses build supplier segmentation, contract terms and onboarding controls into procurement, and work alongside your IT or security advisers on the technical assessment.
To check how your critical suppliers manage risk, see our supplier audit service.
Frequently asked questions
What is a supply chain attack?
A cyber attack that reaches a target organisation through a trusted supplier, such as a software vendor or IT service provider.
How can procurement reduce supply chain attack risk?
By tiering suppliers by risk, requiring security assurance and contract clauses, limiting access and checking suppliers over the life of the contract.
Further reading
- Supply chain security guidance: National Cyber Security Centre
- Cyber Essentials: National Cyber Security Centre
- Cyber security breaches survey: GOV.UK
Related insights
More practical reading on procurement, cost and supply chain.
An illustrative project from brief to first shipment, with a landed cost comparison of China, Turkey and Portugal.
Write the specification, search well, tell factories from traders and compare on landed cost.
Estimate landed cost per unit with freight, insurance and duty, and import VAT shown separately.
Discuss your procurement priorities
Book an introductory call with Caventis to discuss your requirements.