In the first part of this blog, we covered how critical business services today increasingly depend on multiple third parties, ranging from cloud providers, software vendors, and managed service providers to payroll platforms, CRM systems, and consultants. It recommends looking at vendor risk management more closely.
That starts with understanding what the supplier can affect in practice, why it’s important to rank suppliers by risk, and then diving deeper into what a good vendor risk assessment should examine.
The next point to make is about how to go about gaining this understanding. Traditionally, this might have involved an annual questionnaire, but here’s why that’s only of limited use.
That’s because a questionnaire only tells you what the supplier says about itself at a particular moment in time. They can complete a questionnaire in January and experience significant changes during the following eleven months, such as:
- Launching a new internet-facing service
- Acquiring another company
- Migrating infrastructure
- Experiences a data breach
- Introduces a vulnerable application
- Allows a TLS certificate to expire
- Develops a critical vulnerability
- Appears in threat intelligence reporting
- Exposes administrative interfaces
- Suffers a ransomware infection
- Announces a major security incident.
None of these developments will necessarily appear in last year’s spreadsheet. For critical vendors, you should think of the assessment as the beginning of the relationship rather than the end of the dialogue.
Moving from assessment to continuous vendor monitoring
A stronger approach is to supplement the formal vendor assessment with an annual vendor security monitoring service. The service maintains oversight of selected critical suppliers throughout the year rather than reassessing them only at contract renewal.
External asset discovery and monitoring
The organisation should monitor the supplier’s publicly visible technology footprint. External discovery can identify domains, subdomains, IP addresses, cloud services, certificates and other assets associated with the vendor. This can highlight situations where previously unknown or newly created infrastructure becomes exposed to the internet. The objective is not to conduct intrusive testing against the supplier but to understand what an attacker can already observe from the public internet.
Attack-surface and vulnerability monitoring
Internet-facing systems should be monitored for security weaknesses and exposures. The important thing is the trend. A single vulnerability may not represent a material change in risk. A persistent pattern of critical vulnerabilities, however, may indicate weaknesses in the supplier’s vulnerability management programme.
Security news and incident monitoring
Technical monitoring only identifies part of the picture. Critical suppliers should also be monitored using relevant cybersecurity intelligence and commercially available tools such as UpGuard. Speed matters. If a critical supplier announces an incident on Tuesday, discovering it during the annual supplier review six months later provides very little value. Make sure the monitoring watches for:
- Ransomware incidents
- Confirmed breaches
- Data leaks
- Regulatory action
- Vulnerability exploitation
- Security advisories
- Significant outages
- Acquisitions
- Major infrastructure changes
- Incidents affecting important subcontractors.
Actionable alerts when risk changes
Continuous monitoring becomes valuable when information turns into action. The organisation should define thresholds that trigger a review.
- Critical alert: confirmed vendor breach, ransomware incident, exposed credentials or evidence that your own organisation’s data may be affected.
- High alert: critical internet-facing vulnerability, significant service outage or confirmed exploitation affecting technology the supplier uses.
- Medium alert: deterioration in external security posture, recurring vulnerabilities or significant changes to the supplier’s infrastructure.
Each alert should generate a clear decision. Does your organisation need to contact the supplier, rotate credentials or tokens, disable an integration, investigate exposure, update the risk register or inform senior management? This is not about generating more security alerts: it’s about identifying changes in supplier risk early enough for you to do something about them.
What good vendor risk management looks like
An effective programme combines due diligence, contractual governance and continuous technical assurance. Here’s a timeline of the steps we suggest:
Before onboarding
Classify the supplier, understand the service, assess information and system access, perform due diligence and agree security requirements.
At contracting
Define security obligations, notification requirements (NIS2 entities have specific obligations in this area), audit rights, recovery expectations, data protection responsibilities, and exit provisions.
During the relationship
Monitor the supplier’s external security posture, vulnerabilities, incidents and relevant cybersecurity intelligence.
When risk changes
Investigate the issue, contact the supplier, assess exposure and take proportionate action.
At least annually
Perform a formal reassessment using the accumulated monitoring information rather than starting again with a blank questionnaire.
At termination
Remove accounts, revoke OAuth tokens and API keys, terminate remote access, recover or delete information and obtain appropriate confirmation of data deletion. This approach is increasingly consistent with regulatory expectations, including the EU’s focus on ICT supply chain security and NIS2 supply chain risk management.
The real objective: knowing when trust should change
Vendor risk management is sometimes treated as a compliance exercise designed to prove that suppliers were assessed, but that misses the point. The real objective is to answer a much more important question that echoes Ernest Hemingway’s line: can we continue to trust this supplier with the access, information and operational dependency we have given them?
Moving vendor risk from annual paperwork to continuous assurance using a tool like UpGuard will help you answer that question.
Noel Barbour is head of the cybersecurity practice at BH Consulting.
