Arcanum Technical Director, Lawrie Abercrombie, outlines the integral role that supply chains now play in almost every organisation’s operations – and why that can generate risks that need to be managed with care through rigorous supplier assurance.
Most organisations rely on suppliers for systems and services that are now central to how they operate for example cloud platforms, managed tooling, specialist engineering support, outsourced delivery and operational resilience. That dependence is unavoidable and often valuable. But, it also means that a supplier’s weak security controls, poor evidence, unmanaged subcontractors or slow remediation can quickly become your operational problem, regulatory concern and reputational exposure.
Good supplier assurance is not just a questionnaire issued during procurement and filed away once the contract is signed. It gives the organisation a practical view of which suppliers matter most, what risk they introduce, whether their evidence can be relied on and what action is needed: accept, remediate, monitor or escalate.
The pain points are usually easy to recognise. Procurement teams need to onboard suppliers quickly. Cyber and risk teams are asked to review long questionnaires with little time and patchy evidence. Business owners need the service in place, but may not have a clear view of the residual risk being accepted. Legal and commercial teams may have security clauses in the contract, but in our experience there’s usually no right of audit to prove that the supplier does meet them in practice. As an example, one client had a contract for an external supplier to provide secure destruction of its old IT equipment but when we happened to be driving by their depot, we saw piles of hard drives just dumped outside their building. When we told Commercial they told us categorically that we couldn’t use that knowledge as we had no right of external audit.
The process can become busy without becoming effective. Manual reviews, uneven supplier tiering, weak evidence packs, procurement delays, slow remediation tracking and board reporting that still does not give a clear picture of third-party cyber risk. In higher-risk environments, that creates avoidable exposure to supplier-led disruption, data compromise, compliance issues and customer assurance challenge.
Supplier risk tends to move up the agenda when something changes. That might be a major outsourcing decision, a cloud migration, a new ERP or identity platform, the adoption of a managed SOC, OT modernisation, remote access for a third party, SaaS consolidation, or the appointment of a new MSP, systems integrator, engineering partner or other critical service provider. Other triggers sit outside the technology function e.g. a new customer assurance requirement, contract renewal, a regulatory review, cyber insurance scrutiny, a supplier incident, a supply chain dispute, an audit finding or the realisation that current questionnaires are not giving decision-makers enough confidence. Defence, government, CNI and regulated commercial organisations feel this pressure particularly strongly because supplier evidence often needs to stand up to customers, auditors, regulators and boards.
For some organisations, particularly those in the CNI, supplier assurance is already a legal or regulatory expectation. The UK NIS Regulations require Operators of Essential Services and relevant Digital Service Providers to take appropriate and proportionate measures to secure the network and information systems that support essential and digital services. The government’s new Cyber Security and Resilience Bill, when it comes in, is intended to strengthen that regime, including by bringing more managed service providers into scope and enabling regulators to designate critical suppliers where disruption could affect essential or digital services.
NCSC’s Cyber Assessment Framework is also explicit on the point. Principle A4 expects organisations responsible for essential functions to understand and manage security risks arising from suppliers, including outsourced and cloud-based services. It makes clear that accountability for protecting an essential function remains with the organisation, even when a third party operates part of the service or provides technology on which it depends.
Both CAF V4.0 and the relatively Defence Cyber Certification make the flow-down point specific. Under CAF Principle A4, organisations using third-party services should ensure that contractual agreements provide for the protection of the assets, networks, services and data on which the essential function depends and that security requirements derived from the rest of the CAF principles are reflected in what is procured or outsourced. In the defence context, the MOD Cyber Security Model, delivered through IASME’s Defence Cyber Certification scheme, requires suppliers to meet the controls associated with the relevant cyber risk profile and to flow requirements down where they subcontract. Subcontractors must be risk assessed and complete the appropriate Supplier Assurance Questionnaire, making supplier assurance a contractual and supply-chain obligation rather than an optional good-practice exercise.
Boards are being pointed in the same direction. The UK Cyber Governance Code of Practice asks directors to gain assurance that supplier information is routinely assessed, proportionate to risk and that the organisation is resilient to cyber security risks from its supply chain and business partners. In other words, supplier assurance is no longer just an operational procurement activity. It is part of governance, resilience and evidence of reasonable oversight.
Arcanum’s Supplier Assurance service helps organisations understand and manage cyber risk introduced through suppliers and third parties. It can be used for a focused review of one critical supplier, support to a procurement or onboarding decision, a targeted evidence review, or the design of a repeatable assurance model for procurement, cyber risk and compliance teams.
The work can cover supplier criticality and tiering, inherent risk profiling, questionnaire and evidence review, contractual security obligations, supplier security architecture, data flows and trust boundaries, remote access, remediation tracking and risk reporting. Where appropriate, we’ll align the review with recognised frameworks and assurance expectations, including CAF, NIS, ISO 27001, Cyber Essentials, DCC, PCI DSS, Official-Sensitive handling and board-level risk reporting.
The point is to make the evidence useful. We help clients separate a real control weakness from an unclear answer, a weak evidence pack, an unsupported supplier claim or a contractual gap that needs commercial attention. That matters because each issue needs a different response. Some require remediation, some monitoring, some contractual clarification and some formal acceptance of residual risk.
Done well, supplier assurance gives organisations better visibility and control over third-party cyber risk. It focuses effort on the suppliers that matter, improves procurement and onboarding decisions, supports contract renewal and customer assurance activity and reduces the likelihood of disruption, data compromise, compliance failure and reputational damage.
Outputs typically include a supplier criticality and tiering model, supplier risk assessment, evidence review findings, questionnaire recommendations, security architecture observations, remediation plan, risk register entries, management report, board-facing summary and a repeatable operating model for supplier onboarding, monitoring and escalation.
The most useful outcome is a clearer basis for decision-making. Which suppliers are critical? What risk do they introduce? What evidence supports their claims? What needs to change? Who owns the residual risk? How will progress be tracked?
Supplier assurance is not solved by adding more questions to a spreadsheet. It is solved by asking better questions, reviewing the right evidence, focusing attention on the highest-risk relationships and turning findings into practical decisions. For organisations with complex, regulated or operationally critical supply chains, this is part of cyber resilience, governance and commercial confidence.
If your organisation is reviewing supplier risk, dealing with supplier assurance backlogs, preparing for customer or regulatory scrutiny, or trying to build a more repeatable assurance model, Arcanum can help. Book an initial consultation to discuss where the current process is under strain and how to move towards clearer, evidence-led supplier risk management.