__________________________________________________________________________________________________
Cybersecurity
reporting a suspected compromise. Contracts should also define who is financially and operationally responsible if a supplier’ s vulnerability causes a downstream breach in a company’ s network.
Once the contract is signed, it is increasingly common for companies to require a Software Bill of Materials( SBOM) for software and firmware, that allows the identification of known vulnerabilities within supplier’ s IT Infrastructure. Tools can also be deployed to provide real-time security ratings based on public-facing telemetry. Companies should also define vulnerability disclosure requirements so that suppliers have a clear, public way to report and receive security flaws.
It’ s also vital to consider fourth-party risks management and ensure suppliers are checking their suppliers. This should include a requirement for sub-contractor transparency – while a Tier 1 supplier is secure, their coding may be outsourced to a Tier 4 firm with no security, putting the company is at risk. Flowdown clauses in contracts also mean that security requirements go from a supplier to their subcontractors.
As cyber threats can arise internally or via third-parties that have access to critical data, every part of the supply chain should embed cybersecurity in the design phase of any product, service or underlying process. Likewise, comprehensive training for employees and other stakeholders is key to mitigating cyber risks, with an active culture that engages employees in cybersecurity being encouraged. Cybersecurity needs to be seen as a business-enabling priority for management and flow down throughout the organization and supply chain, irrespective of business size and location. ■
Chris Whyborn www. tuvsud. com
Chris Whyborn is the Head of Cybersecurity Services( UK and Europe) at TÜV SÜD. Chris has more than 40 years of security and investigations experience in a wide variety of operational, management, policy and consultancy roles. This includes providing risk assessment and security advice to senior ministers and diplomats from UK and EU nations.
scw-mag. com 21