Third-Party and Supply-Chain Risk for Small Businesses

The risk you do not control

Most small businesses think about security in terms of their own laptops, email and passwords. That matters, but it is only part of the picture. Every firm now depends on a web of outside suppliers: cloud accounting, file storage, a website host, a payments provider, an IT company, the apps your team logs into every day. Each of those is a link in your supply chain, and each one can become your problem.

Supply-chain risk is simply the danger that comes from the companies and software you rely on. If one of them is hacked, suffers an outage, or handles your data carelessly, the consequences land on you, even though the failure happened somewhere you cannot see.

This is not a rare, exotic threat. Some of the most disruptive incidents in recent years spread because attackers compromised one popular product or service, and everyone using it was hit at the same time. You do not have to be a target to be a victim.

Why suppliers are an attractive way in

Attackers like the supply chain for a cold, practical reason: it is efficient. Breaking into one small business gets them one small business. Compromising a widely used piece of software or a managed service provider can get them hundreds of victims at once.

You do not have to be a target to be a victim.

There are a few common shapes to the risk:

• Compromised software. A trusted app you install pushes out an update that has been tampered with, carrying malware to everyone who installs it.
• A breached supplier. A company that holds your data is hacked, and your customer records are exposed even though your own systems were untouched.
• A supplier’s access being abused. An IT provider or contractor with remote access to your systems is compromised, and that access is turned against you.
• Downtime. A key cloud service goes offline and takes part of your business with it, with no fault of your own.

Understanding these shapes helps you focus. You are not trying to audit the entire internet; you are trying to know who you truly depend on and whether they can be trusted.

Start by mapping who you rely on

You cannot manage risk you cannot see. The first step is a simple list of the suppliers and software that matter, focusing on two questions: do they hold our data, or do they have access to our systems? Those are the ones that can hurt you most.

For each, note what they do for you and how badly you would be affected if they were breached or went down. You will quickly find that a handful of suppliers carry most of the risk, your email and file storage, your accounting platform, your website host, your IT provider, and it is those you should concentrate on. A supplier that sells you stationery does not need the same scrutiny as one holding your customer database.

What to ask before you trust a vendor

You do not need to be technical to vet a supplier. You need to ask sensible questions and pay attention to how readily they answer. Reputable suppliers expect these questions and respond clearly. Vague, defensive or dismissive answers are themselves a warning sign.

Worth asking before you hand over data or grant access:

• Where is our data stored, and who can see it? You want a clear answer, ideally with data held in the UK or EU.
• Do you hold a recognised security certification? Cyber Essentials, Cyber Essentials Plus or ISO 27001 show they have been checked against a standard rather than just making claims.
• Do you use MFA and encryption? Multi-factor authentication on accounts and encryption of stored data are basic expectations now, not extras.
• How and how quickly would you tell us about a breach? You need to know they will not sit on bad news, especially as you may have your own reporting duties.
• What happens to our data if we leave? Can you get it back, and is it deleted afterwards?
• How do you control staff and contractor access to our systems? Especially relevant for IT suppliers with remote access.

Keep the answers on file. If a supplier will not engage with basic questions like these, that tells you something important about how they treat security day to day.

Reduce the damage if a supplier fails

Even the best vendor can have a bad day, so it is wise to limit how much any single supplier can hurt you.

• Give suppliers only the access they need. An outside contractor rarely needs full admin rights. Least privilege applies to suppliers just as it does to staff.
• Turn on your own MFA for every service a supplier provides, so a breach on their side is harder to ride into your accounts.
• Keep your own backups. Do not assume a cloud provider is backing up your data the way you would want. A solid 3-2-1 backup approach means you can recover even if a supplier loses your data or goes offline.
• Watch out for supplier impersonation. Attackers who breach a supplier often use it to send convincing invoices or emails. Awareness of business email compromise helps your team spot a supplier account that has been hijacked.

Make it a habit, not a one-off

Suppliers change, and so do the risks. Once a year, revisit your list: are these still the right providers, do they still meet your standards, and has anyone gained access they no longer need? Under UK GDPR you remain responsible for personal data even when a supplier handles it, so this review is part of your compliance as well as your security.

Third-party risk can feel large because it sits outside your walls, but the response is manageable: know who you depend on, vet the ones that matter, limit their access, and keep your own backups. If you would like help reviewing your suppliers and tightening the connections into your business, our cyber security service is a good place to start, or simply get in touch and we will talk it through.