Does a cyber risk assessment include third-party and supply-chain risks?

A cyber risk assessment should treat external relationships as risk pathways into, out of and around the organisation, rather than simply recording a list of suppliers. The assessment considers what each relationship can access, what business process depends on it, how a compromise or outage could spread, and whether existing safeguards reduce the risk to an acceptable level.

The scope should include more than direct suppliers. Relevant parties may include outsourced IT providers, software and cloud service providers, payment processors, logistics partners, facilities contractors, recruitment agencies, professional advisers and temporary staff. The assessment should also consider fourth-party dependencies: for example, a critical software provider may itself rely on a hosting company, data processor or external support platform. These indirect dependencies can be difficult to identify, but they may still affect the organisation’s exposure.

Not every supplier needs the same level of scrutiny. A useful assessment groups third parties according to factors such as:

• the sensitivity and volume of data they handle;
• the systems, networks or accounts they can access;
• whether they can make changes to production systems or security controls;
• the importance of their service to daily operations;
• the potential effect of their failure on customers, employees, compliance or safety;
• how easily the organisation could replace the supplier or operate without it; and
• the supplier’s own use of subcontractors and external service providers.

A supplier with access to confidential data or privileged administrative functions normally warrants more detailed review than a provider with no system access and a readily available alternative. This risk-based approach helps an organisation focus assurance effort where a third-party incident would have the greatest consequences.

Access pathways are a central part of the review. The assessment should document whether external users connect through remote access tools, application programming interfaces, federated identity, support accounts, shared credentials or direct network connections. It should examine whether access is limited to the systems and information required, whether privileged access is separately controlled, whether multi-factor authentication is used where appropriate, and whether accounts are removed promptly when a contract or role ends. Supplier access that is permanent, shared or insufficiently monitored can create a significant weakness even when the supplier itself is reputable.

The assessment should also examine how information moves between organisations. This includes data exports, file transfers, integrations, email exchanges, backups and physical records. Important questions include where information is stored, which countries or jurisdictions are involved, how long it is retained, who can administer the service, and whether the supplier uses subcontractors to process it. These points help identify risks relating to confidentiality, unauthorised alteration, loss and regulatory obligations.

Due diligence should be supported by evidence. Depending on the relationship, this may include security policies, independent assurance reports, penetration-test summaries, vulnerability-management information, incident records, business continuity arrangements, data-processing terms and details of relevant certifications. A questionnaire can provide useful initial information, but it should not be treated as proof by itself. The assessment should record what was verified, what remains uncertain, when the information was obtained and who accepted any gaps.

Contracts are another important control. Security requirements can address permitted access, encryption, vulnerability management, logging, incident notification, audit rights, data deletion, subcontracting, recovery arrangements and the return of information at the end of the relationship. Contractual wording does not remove technical or operational risk, but it clarifies responsibilities and gives the organisation a basis for checking whether agreed controls are being applied.

Supply-chain scenarios should be tested against the organisation’s actual dependencies. Examples include:

• a software update containing malicious code or introducing a vulnerability;
• a supplier’s compromised credentials being used to enter the organisation’s environment;
• a cloud or communications provider becoming unavailable;
• a third party exposing confidential information through a misconfigured service;
• a subcontractor suffering a ransomware attack that disrupts a critical process; or
• a supplier being unable to provide support, replacements or security updates.

For each relevant scenario, the assessment should record likely consequences, existing safeguards, detection methods, response responsibilities and practical alternatives. This may lead to controls such as network segregation, restricted integration permissions, stronger authentication, independent backups, manual workarounds, alternative suppliers or clearer escalation routes. It may also show that the organisation has accepted a dependency without a realistic fallback.

Cloud services require a shared-responsibility analysis. The provider may operate the underlying infrastructure, while the customer remains responsible for account security, configuration, user permissions, information classification, retention and recovery settings. The assessment should therefore distinguish between controls managed by the provider and controls that the organisation must configure and monitor itself.

Third-party and supply-chain risks should remain part of the risk register, with an owner, treatment decision and review date. A new supplier, major change in access, acquisition, service migration, security incident or change in subcontracting arrangements may require the assessment to be updated. The outcome is not a guarantee that every external dependency is risk-free; it is a documented view of which dependencies matter, how they could affect the organisation and what action is justified to manage the remaining exposure.