The importance of assessing your suppliers' cyber security readiness is paramount. Your company's security is only as good as its weakest link, and any flaws in your supply chain can have severe repercussions.

Whether you are a sole trader, SME, charity, or larger organisation, all businesses operate in an interconnected business landscape, and being aware of this environment is becoming increasingly important.

This includes the procurement process, which should now prioritise cyber security as a critical factor in order to protect sensitive data, ensure business continuity, and protect the entire supply chain ecosystem.

If your company, charity, or other organisation isn't already doing so, it's time to start assessing the cyber security posture of your supply chain in order to identify vulnerabilities and mitigate the very real risks that exist.

Organisations must incorporate cyber security standards into their procurement process to address potential risks and ensure supply chain partners follow recommended security practises.

Cybercriminals will frequently target weak links in the supply chain in order to gain access to your networks, allowing them to exploit vulnerabilities and compromise your critical systems, such as by deploying malware. So, what are the risks of not considering cyber security when planning your supply chain?

Without sufficient safety precautions in place, an organisation may be vulnerable to:

• Data breaches: If your supply chain has a poor cyber security culture, this can lead to data breaches, where sensitive data is exposed, resulting in financial, legal, and reputational consequences for both the organisation and its customers.
• Disruptions in operations: A cyber-attack on a supplier's infrastructure has the potential to disrupt the entire supply chain. When critical systems are compromised or unavailable, such as through ransomware, the consequences can include production interruption, delivery delays, and financial losses. Customers and other stakeholders may be affected.
• Reputational harm: A breach in your supply chain might continue to tarnish your company's reputation, eroding customer and supplier trust. We've seen how quickly information about a successful cyber-attack spreads, making it difficult to repair your reputation.
• Impact of regulators: The UK has data protection and privacy regulations, which include a requirement to report a breach to the Information Commissioners Office (ICO). This means that the supply chain has the potential to expose your company to legal penalties, fines, and other consequences.

SolarWinds, which provided system and network management and monitoring tools, was one widely reported example of a successful supply chain cyber-attack. Many of these are used by organisations all over the world. In this case, hackers took advantage of a flaw in the software, allowing them to gain access to the networks of organisations that used it, including email accounts.

There is some speculation on the internet that the attackers exploited a weak password.

There is also the threat of supply chain phishing attacks, which try to dupe the recipient into disclosing information or downloading malware. This has the potential to compromise an account, allowing for further movement up the supply chain from a trusted account.

The good news is that by implementing robust security measures in your procurement process, you can reduce the risks associated with weak password security and phishing attacks within your own supply chain.

Strong password policies, multi-factor authentication, employee training on detecting and reporting phishing attempts, regular security audits of suppliers and partners, and continuous monitoring of network activity for suspicious behaviour should all be included. Maintaining vigilance and promoting a strong cyber security culture throughout the supply chain will help to prevent successful attacks on your own organisation.

Smaller businesses are frequently overlooked by procurement professionals. Due diligence may be in place for IT suppliers, but it invariably falls short when it comes to those providing non-technical services or products.

Some risk-mitigation measures to consider include:

• Comprehensive supplier assessments: Evaluate your potential suppliers' cyber security. Examine their security measures, protocols, incident response plans, and overall security maturity.
• Contract security requirements: Include cyber security specifications as a contractual duty for suppliers. Specify the required security measures, such as encryption, access controls, regular audits, and employee training.
• Continuous monitoring and audits: Conduct periodic audits of suppliers' cyber security practises to ensure compliance with agreed-upon standards. Regular assessments aid in identifying potential vulnerabilities or security gaps.
• Planning for incident response: Work with suppliers to create comprehensive incident response plans. Establish communication channels, roles, and responsibilities, and test the effectiveness of the plans on a regular basis with drills or simulations.
• Security awareness and education: Promote cyber security awareness among suppliers through training programs.

This is where Cyber Resilience Centres (CRC) can help businesses. There are likely businesses of all sizes in your supply chain. However, smaller businesses are less likely to prioritise cyber security, possibly due to a lack of resources, a limited budget, or simply a lack of understanding of the risk.

Encourage your supply chain to join the EMCRC community by simply downloading our information pack in the first instance, so that they can receive ongoing support and alerts. This includes guidance from the National Cyber Security Centre (NCSC), regular updates on attack types, and assistance in obtaining Cyber Essentials certification.

We can also offer discounted entry-point cyber security services such as staff awareness training and vulnerability assessments.

Our goal is to assist businesses and charities in becoming more cyber resilient, making them ideal for larger organisations to use to secure their own supply chains. We can also guide small organisations on the fundamentals of good practise. Even if they do not obtain formal certifications, ensuring that they are aware of and have implemented basic security measures, as well as being aware of the most recent threats, is critical.

The whole CRC network wants your supply chain ecosystem to be safe, and you can help by taking proactive steps to prioritise cyber security. The first step is to encourage joining our community followed by a cyber security certification. You will reduce risks to your organisation by incorporating cyber security standards into the procurement process.

Don't wait for an attack; instead, be proactive and secure your supply chain to protect your data, finances, and reputation.

For more information on supply chain risks and incorporating cyber security into your procurement process, please contact us at info@emcrc.co.uk.

Reporting

Report all Fraud and Cybercrime to Action Fraud by calling 0300 123 2040 or online. Forward suspicious emails to report@phishing.gov.uk. Report SMS scams by forwarding the original message to 7726 (spells SPAM on the keypad).