Vendors and suppliers present a significant cyber risk. According to the Ponemon Institute’s 2022 report, 61% of organizations suffered vendor-related breaches, as threat actors often target suppliers, which impacts a greater number of businesses. To address this, executives should implement robust oversight, establish clear data protection requirements in contracts, and routinely review contingency plans to ensure vendor accountability.
Why Third-Party Risk Matters
IBM’s Cost of a Data Breach Report 2023 found that supply chain incidents increased recovery time and expenses. With regulations like GDPR and HIPAA holding organizations accountable for vendor issues, and cyber insurers now requiring evidence of third-party risk management before policy renewal, neglecting this risk can result in fines, losses, and reputational harm.
What Leaders Should Focus On
- Vendor access and data use: Ask your team, “Which vendors can access our systems or sensitive data, and is that access tightly controlled?” If too many vendors have broad access, even a minor issue can quickly escalate into a serious security problem.
- Due diligence and attestations: It’s best to ask vendors for security attestations or SOC 2 reports, but this isn’t always realistic. Large cloud and tech providers usually don’t offer custom attestations, while smaller or regional vendors might be more open to it. Leaders should have their teams request attestations where possible and consider alternatives like ISO 27001 certification, penetration test summaries, or independent audits when needed.
- Vendor cyber insurance: If a vendor has cyber insurance, that’s a good sign. It means they’ve met the insurer’s requirements, such as using multi-factor authentication, having an incident response plan, and keeping systems updated. This doesn’t guarantee security, but it does show a basic level of responsibility.
- Contractual requirements: Contracts should clearly require things like multi-factor authentication, patch management, encryption, and set timelines for reporting incidents. If these requirements are missing, vendors might not take security seriously.
- Ongoing monitoring: Ponemon’s 2022 study found that only 34% of companies monitor vendor risk after onboarding, leaving major blind spots. Executives should find out if their teams use monitoring tools, do regular reassessments, or use third-party risk platforms, and ensure key findings reach leadership.
- Incident response integration: Many companies find out about vendor breaches from the news before hearing from the vendor. Ask your vendors to let you know immediately if a breach happens and to participate in regular incident response drills with your team.
- Critical supplier contingency plans: Some vendors are critical to your business. If your fueling partner, scheduling system, or payment processor went down, how would you keep things running? Have business continuity plans ready, test them often, and know your backup providers if you can.
- Regulatory and insurance expectations: Regulators and insurers may require proof that your vendors are secure. Teams should maintain both policy documentation and records of reviews, monitoring, and contract enforcement.
- Offboarding and contract termination: Vendor departures pose risks similar to those of onboarding. Ensure that there are procedures to revoke access, recover company data, and certify secure disposal upon contract completion.
- Fourth-party risk (subcontractors): Vendors frequently depend on their own suppliers. Your contracts should mandate the disclosure of subcontractors and your capability to evaluate their security, particularly if they manage your data.
- Data residency and sovereignty: Verify whether sensitive or regulated data is managed and stored in authorized jurisdictions, and if contractual or regulatory obligations (like GDPR or FAA regulations) are fulfilled.
- Concentration risk: Dependence on one supplier or a limited number of them leads to vulnerability. Inquire: “Are we overly reliant on a single provider, and do we have alternatives if they fail?”
- Board reporting and visibility: Vendor risk assessments frequently remain hidden at the IT or Compliance level. Mandate summary reports for senior leadership and the board that highlights essential vendors, significant risks, and trends over the years.
Questions to Ask Vendors
- What systems and data will you have access to, and how is that access restricted?
- Do you offer security attestations, certifications (like ISO 27001), or reports from third-party audits?
- Do you hold cyber insurance, and if yes, does it include coverage for third-party liability?
- What are your requirements regarding multi-factor authentication, patch management, and encryption?
- How quickly will you inform us if a security incident occurs?
- Do you engage in incident response drills with clients?
- How frequently are your security measures tested by an external party?
- What strategies are in place for continuity if your systems become unavailable?
- Do you disclose and assess your subcontractors (fourth parties) that may handle our data?
- Where will our data be stored and processed, and does this meet jurisdictional or regulatory requirements (e.g., GDPR, FAA, HIPAA)?
- How do you mitigate concentration risk, and are alternative providers identified if your services are disrupted?
- How do you report security performance and risk metrics to your customers, and at what frequency?
Executive Takeaways
- Maintain an inventory of all vendors with system or data access, and ensure that access is minimized.
- Require security due diligence for new and renewing vendors, including attestations where feasible and alternatives such as certifications or audit reports where not.
- Give preference to vendors that maintain cyber insurance as a sign of baseline maturity.
- Ensure contracts include enforceable cybersecurity obligations, penalties for non-compliance, and clear reporting timelines.
- Direct your team to continuously monitor vendor security posture and escalate material findings to leadership.
- Integrate vendors into your incident response plans, and require rapid notification of incidents.
- Verify that contingency and continuity plans exist for critical suppliers, and that they are tested.
- Confirm that your vendor risk program meets regulator and insurer expectations and is evidence-based.
- Require a formal process for offboarding vendors, including revoking access, retrieving data, and certifying secure disposal.
- Insist on visibility into subcontractors (fourth parties) that handle your data, with risk assessments where appropriate.
- Confirm that vendor data storage and processing meet jurisdictional and regulatory requirements.
- Assess concentration risk by identifying over-reliance on single vendors and developing alternatives.
- Ensure vendor risk reporting reaches the executive and board level, highlighting critical vendors, high-risk findings, and trends.
The Bottom Line
Managing third-party risk is essential. A vendor breach can be costly, lead to fines, and harm your organization’s reputation. As an executive, you don’t need to audit every supplier, but you must ensure strong oversight, clear contracts, ongoing monitoring, and backups. By asking the right questions and requesting proof, you can lower risk, increase insurance coverage, and strengthen your supply chain.