Many business owners think of ICT security mainly in terms of their own network, their own laptops and their own passwords. That makes sense, because that’s the part you can see and touch. A large part of your vulnerability, however, sits somewhere else: with the software supplier hosting your accounting package, with the party running your inventory system, with the carrier looking into your planning system through an integration. The moment one of them has a problem, that problem can reach you. The door opens through a lock that isn’t yours.
Your own systems aren’t the whole story
For a wholesaler, a manufacturer or a logistics provider, this isn’t some distant concern. You probably work with ten, twenty or more external parties who at some point have access to customer data, inventory information or planning data. Software you use for invoicing, for track-and-trace, for staff scheduling: there’s a supplier behind all of it, and that supplier can be vulnerable too. For each of these parties, you trust, more or less silently, that they have their own security in order.
Trust is not a policy
That silent trust is the real problem. Suppliers aren’t inherently unreliable; the issue is that you simply don’t know. You often lack an overview of who has access to what, which supplier processes which data, and what happens if that supplier is hit by an outage or an attack. Without that overview, you can’t make a considered decision about who you do and don’t grant that access.
At Motics, we often see companies take this risk seriously only after something has gone wrong at a party they work with. It then turns out nobody really knew which supplier could reach which systems, and that no agreements were in place for what should happen if things went wrong. That’s an uncomfortable way to find out how dependent you actually are.
Measure first, then set policy
Our approach doesn’t start with drawing up strict requirements for suppliers. Those requirements come later, and they only have value once you know what to aim them at. The first step is simply mapping things out: which suppliers do you have, what do they do for you, and what data and systems can they access. That sounds simple, but in practice this overview is incomplete or outdated at most small and medium-sized businesses.
Only once that picture exists can you build targeted policy. Which suppliers are critical to your operations? Who has access to sensitive data, and who only to a limited part of your systems? What agreements do you want to put in place about reporting incidents, about security requirements, about what happens when a contract ends? Policy based on a complete overview stands on firmer ground than policy based on a gut feeling.
What you can do right now
You don’t need to wait for a large project to get started.
Map out which suppliers and software providers have access to your systems and data. A simple spreadsheet overview is already a good start, as long as it stays complete and current.
Determine, per supplier, how critical their access really is. A party that only hosts your website is different from one that manages your entire customer database.
Set out what you expect from your most important suppliers regarding security and incident reporting. This doesn’t need to be a thick contract, but it should be more concrete than a verbal agreement.
Involve the people who work with these suppliers day to day. They’re often the first to notice when something feels off, and they need to understand why new agreements exist before you impose them.
This also matters for NIS2
If your company falls under the NIS2 directive, or if you’re taking it into account, supplier management is one of the areas regulators look at. The point isn’t that you can guarantee or certify every supplier. The point is that you can show who your suppliers are, what risk they bring, and what agreements you’ve put in place about it. That’s what we call being demonstrably aligned with NIS2: a file that holds up when someone asks how you’ve arranged this, rather than an impression based on feeling.
Overview is the beginning, not the end
Supplier management isn’t a project you finish and then forget about. Suppliers change, contracts end, new parties come on board. The overview you build now only has value if you keep it current and review it periodically. We’d rather think in terms of your entire network of supplier relationships than a single document or a one-off check, because only then does the picture keep matching reality.
A few questions we’re often asked
Do I need to assess every supplier equally strictly?
No, that wouldn’t be workable either. Start with the suppliers who have access to sensitive data or who are critical to your operations, and expand from there. A supplier who only services your office coffee machine calls for a different approach than your accounting package.
What if a supplier won’t cooperate with our requirements?
That happens, and then you have to weigh your options. Sometimes a supplier is simply too important to replace quickly, so you add extra measures on your own side. Other times, it’s a clear signal to start looking for an alternative.
How much time does it take to build this overview?
For most small and medium-sized businesses, a first usable version can be put together within a few weeks, especially if you start with your most important suppliers. Keeping it accurate and current afterwards is a matter of routine, not a new major project.
Is this only relevant for companies that fall under NIS2?
No. Even without a legal obligation, you carry risk through suppliers who have access to your systems. NIS2 simply gives you a clear reason to approach this overview seriously and in a structured way, instead of putting it off.
Want to know how to get a grip on your suppliers and which risks matter most for your business? At Motics, we’re glad to think this through with you, starting from overview rather than assumptions.
