Cyber risk from suppliers

Field 1Start with a list

ASD’s first step is to write down who you have business arrangements with: suppliers, manufacturers, distributors and retailers, and where you can, their subcontractors. It accepts that a complete list may not be possible, and says to start with whoever is responsible for products or services that enforce security, operate with privileged access, handle sensitive data, or will be used in sensitive locations.

It also asks you to know what your data is worth, including the data you hand to other businesses.

Field 2The five steps

1. Identify the cyber supply chain: the list above.
2. Understand the risk each supplier poses. ASD names the usual sources: foreign control or interference, weak security practice, too little transparency, ongoing access to your systems, and poor business conduct. The result can be a list of trusted suppliers and a list of high-risk ones not to use.
3. Set expectations in contracts or memorandums of understanding where you can, kept proportionate to the data and the supplier’s role.
4. Audit for compliance through routine audits or technical assessments, with the right to do so written into the contract.
5. Monitor and improve together: shared security goals, sharing good practice and threat information, helping each other respond to incidents, and joint exercises.

Field 3Questions to put to a supplier

ASD’s guide to identifying supply chain risks groups its questions under five headings. A selection, in our words:

Ownership and control

• How far is the business foreign-owned or run, who holds the controlling shares, and where is it headquartered and operating?
• What could a foreign government reach by controlling or influencing it?

Security practice

• Does it follow a cyber security standard for its own systems, and does it have a vulnerability disclosure policy?
• Does it manage the risks in its own supply chain, and has it identified every third party involved in what it delivers?
• Has it, or its product, been compromised before, and how did it handle that?

Transparency

• Will it support penetration testing, and share the results of past assessments against security standards?
• Can security requirements, mandatory incident reporting and a right to audit be written into the contract?

Access and privileges

• How much access will its product or service have to your systems and data, and does it need privileged or ongoing access?
• Will your data be accessed or stored anywhere other than a low-risk country?

Business practice

• Is there evidence of unethical or criminal conduct, intellectual property theft or counterfeit products?
• Has any country banned its products or services over privacy or security concerns?

Field 4What goes in the contract

ASD calls it critical that agreements with suppliers require cyber security incidents to be reported to customers and the appropriate authorities, openly and in good time. It also suggests the expectations shouldn’t be excessively restrictive unless the supplier supports highly sensitive systems or facilities: they should be justifiable, achievable and in proportion.

As an example, ASD suggests a business might ask its suppliers to show good-faith efforts to apply the cyber security principles in its Information security manual, or its Essential Eight maturity model. A “right to audit” clause gives the customer a way to check.

Field 5Managed service providers

An IT provider that runs your systems often holds privileged access to them, so ASD has a short list of questions for managed service providers:

1. Q1Are you putting the Essential Eight in place?
2. Q2Are you administering your systems and services securely, especially remotely?
3. Q3Are you monitoring activity on your systems and services?
4. Q4Are you regularly assessing your systems and services for vulnerabilities?
5. Q5Are you prepared for, and able to respond to, a cyber security incident?

Field 6Your own place in the chain

The risk runs downstream as well. ASD points out that a business passes the supply chain risk it holds on to its own customers, so it should consider the risk it poses to them, not only the risk its suppliers pose to it.

ASD runs the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), the number it gives for questions about this guidance.