Chapter 4 of 12 · Annually, and after any big supplier change
Q4: Which Suppliers Could Take Us Down?
- How exposed are we through our vendors?
- What happens if a key supplier is breached?
Many serious incidents start at a supplier: a cloud host, a payroll firm, an IT provider with access to your network. The company is still accountable to its own customers when that happens.
What you should hear
- A short list of the suppliers that hold sensitive data, have access to your systems, or would stop operations if they failed.
- What the contracts say about telling you about a breach, and how quickly.
- A plan for the first day after a key supplier announces an incident.
Red flags in the answer
- Every supplier gets the same questionnaire, regardless of risk.
- Nobody knows which suppliers have admin access.
- "They are certified, so we are covered." A certificate is not a plan.
The question you might not ask out loud
Isn't supplier security the supplier's problem?
Their failure becomes your outage or your data breach. Customers and regulators will ask what you did to choose and watch the supplier, and what you did when it went wrong.
Follow-up
"If our most important supplier announced a breach tomorrow morning, who would call whom, and what would we decide by lunchtime?"
Why this matters: the company's attack surface now includes every supplier with access to its data or systems. A board that only discusses its own controls is looking at part of the picture.
Ask whether the company has ever walked away from a supplier, or changed a contract, because of security. If the answer is never, supplier reviews may be paperwork that does not change decisions.
Rule of thumb:The supplier you have never discussed at board level may be the one with the keys.