Third-party and supply chain cyber risk is the exposure you inherit from vendors, partners and software providers with access to your systems or data. Many breaches now start with a trusted supplier. Managing it means vetting vendors before you onboard them, setting security requirements in contracts, and monitoring the risk over the life of the relationship.
What Third-Party and Supply-Chain Risk Means
Most organisations no longer operate within a closed IT environment. They rely on cloud platforms, managed service providers, software vendors, consultants, payment providers, logistics companies and other external partners to operate their business.
Every one of those relationships can introduce cyber risk.
Third-party risk refers to the security exposure created by an external organisation that provides services to your business or has access to your systems, networks or information. Supply-chain risk is broader. It can include the technology, software, infrastructure and other dependencies that sit behind a supplier’s service.
The Australian Cyber Security Centre recommends considering cyber supply-chain risks throughout the procurement lifecycle, including when systems and services are designed, delivered, operated, maintained and eventually decommissioned. Its guidance also highlights the importance of considering jurisdictional, governance, privacy and security risks associated with suppliers.
The important point is that supplier risk does not disappear simply because the supplier is outside your organisation.
If a vendor has access to your environment, their security can affect yours.
How Breaches Start With a Trusted Supplier
There are several ways an attacker can use a supplier relationship to reach a target organisation.
Compromised vendor credentials
A supplier may have legitimate access to your systems through remote administration tools, VPNs, cloud applications or privileged accounts. If those credentials are stolen, an attacker may be able to use the supplier’s legitimate access rather than exploiting your perimeter directly.
This makes third-party access particularly important to review. A vendor account that has unnecessary privileges or remains active after a project ends can become an overlooked route into the environment.
Compromised software or services
Supply-chain risk also exists within the technology your vendors provide.
Software can contain vulnerable third-party components, insecure configurations or malicious code. The ACSC’s Information Security Manual includes controls addressing software supply-chain transparency, including the use of software bills of materials where available to help identify components and manage associated risks.
Data exposure
A supplier does not necessarily need direct network access to create a security problem.
If a business sends customer information, employee records, financial information or intellectual property to a third party, the security of that data becomes part of the organisation’s overall risk profile.
The result is a simple principle:
Your security boundary extends beyond your own infrastructure.
Vet Vendors Before You Onboard Them
Vendor security should be assessed before access is granted, not after the relationship is already operational.
The level of due diligence should depend on the risk posed by the supplier. A vendor that provides office stationery does not require the same assessment as a cloud provider hosting sensitive customer information.
Start by identifying what the supplier will actually have access to.
Ask:
- What systems will the supplier access?
- What information will it handle?
- Will it have privileged access?
- Can it connect remotely?
- Does it subcontract any part of the service?
- Where is data stored and processed?
- Which countries are involved?
- What happens if the supplier suffers a security incident?
- How quickly will the supplier notify you?
- What security controls does the supplier operate?
A security questionnaire can provide a useful starting point, but questionnaires should not be treated as proof of security.
Where appropriate, request supporting evidence such as independent assurance reports, certifications, penetration testing summaries, security policies, incident response procedures and relevant audit reports.
For higher-risk suppliers, consider conducting a more detailed security risk assessment before the relationship begins.
The objective is not to eliminate all supplier risk. That is rarely realistic.
The objective is to understand the risk well enough to decide whether it is acceptable, what controls are required, and who is responsible for managing it.
Put Security Requirements in the Contract
A vendor assessment has limited value if the supplier is not contractually required to maintain appropriate security.
Security expectations should be reflected in contracts and service agreements, particularly where the supplier handles sensitive information or provides a critical service.
Depending on the relationship, contractual requirements may cover:
- Minimum security controls
- Multi-factor authentication
- Access control and least privilege
- Encryption
- Vulnerability and patch management
- Security testing
- Incident notification
- Data breach notification
- Data storage and processing locations
- Subcontractor management
- Business continuity
- Backup requirements
- Audit or assurance rights
- Security reporting
- Secure termination and data destruction
Incident notification is particularly important.
Your organisation should know what constitutes a security incident, who the supplier must notify, how quickly notification must occur and what information must be provided.
You should also consider your right to obtain evidence or assurance that agreed controls are actually operating.
For organisations subject to APRA requirements, this becomes especially important. APRA’s current CPS 230 requires APRA-regulated entities to manage risks associated with service providers, maintain a service provider management policy, use formal agreements for material arrangements and monitor those arrangements.
APRA’s guidance also makes an important point: using a service provider does not transfer responsibility for managing the associated risk away from the regulated entity.
Monitor Vendor Risk Throughout the Relationship
One of the most common mistakes in vendor risk management is treating security as a one-time onboarding exercise.
A supplier that passed your assessment two years ago may not present the same risk today.
The supplier may have:
- Changed ownership
- Introduced new technology
- Added subcontractors
- Moved data to another jurisdiction
- Experienced a security incident
- Changed its privileged access model
- Introduced new cloud services
- Changed its security certifications
- Become more critical to your operations
That means vendor risk should be reviewed throughout the relationship.
The frequency should reflect the supplier’s risk. Critical suppliers may warrant more frequent reviews, while lower-risk vendors may require a lighter approach.
Monitoring can include annual security reviews, updated questionnaires, certification checks, vulnerability intelligence, breach notifications, contract reviews and reassessment after significant changes.
For high-risk suppliers, organisations should also understand the fourth parties behind the service.
This is particularly relevant under CPS 230. APRA requires entities to consider fourth parties that material service providers rely on when delivering a critical operation.
The supply chain therefore does not necessarily stop at your direct supplier.
Australian Requirements and Supply-Chain Risk
Third-party risk is becoming increasingly important within Australian cyber security and operational resilience frameworks.
APRA CPS 230
For APRA-regulated organisations, CPS 230 specifically addresses service provider risk. The standard requires organisations to identify material service providers and manage the associated risks through appropriate policies, agreements and monitoring.
APRA also requires due diligence before entering into or materially modifying a material arrangement. This includes assessing the service provider’s ability to provide the service on an ongoing basis and considering financial and non-financial risks associated with reliance on that provider.
SOCI Act
For organisations subject to the Security of Critical Infrastructure Act 2018, supply-chain considerations can form part of the broader risk management and security obligations applicable to critical infrastructure assets.
The exact obligations depend on the relevant asset, sector and circumstances, so organisations should assess their specific regulatory requirements rather than treating supply-chain security as a single checklist.
Essential Eight
The Essential Eight remains focused primarily on an organisation’s own environment rather than serving as a complete third-party risk management framework.
However, its controls can still inform supplier security requirements. For example, organisations can consider whether suppliers with privileged or remote access use appropriate authentication, restrict administrative privileges and maintain effective patching and application controls.
The broader principle is that supplier access should not create an unmanaged exception to your internal security standards.
Build a Risk-Based Vendor Assessment Process
You do not need to treat every supplier identically.
A practical approach is to classify vendors according to risk.
A low-risk supplier might have no access to systems or sensitive information. A medium-risk supplier may handle business information or have limited system access. A high-risk or critical supplier may have privileged access, process sensitive information or support a critical business operation.
Your assessment should then become more rigorous as the risk increases.
For a high-risk supplier, you might require:
- Detailed security due diligence
- Evidence of security controls
- Independent assurance or certification
- Contractual security requirements
- Defined incident notification obligations
- Regular reassessment
- Access reviews
- Business continuity information
- Subcontractor visibility
- Exit and contingency planning
This creates a more defensible process than sending every vendor the same questionnaire.
What Happens When a Vendor Fails the Assessment?
A failed assessment does not automatically mean the supplier must be rejected.
The first question should be whether the risk can be reduced.
For example, a supplier may require access to a particular application but not the underlying network. Access could potentially be restricted, privileged accounts could require MFA, permissions could be reduced and activity could be logged.
You can then reassess the remaining risk against your organisation’s risk appetite.
If the risk remains unacceptable, alternatives may include negotiating additional controls, changing the contract, selecting another supplier or introducing compensating controls.
The important thing is to make the decision deliberately.
Accepting supplier risk without understanding it is very different from accepting a documented risk that has been assessed, approved and monitored.
How Intrix Can Help
Managing third-party and supply-chain risk requires more than sending vendors a questionnaire.
Intrix’s supply chain risk management services can help organisations identify supplier-related exposure, assess the security risks associated with third-party relationships and establish a more structured approach to vendor risk.
Intrix can also support organisations through security risk assessments that identify weaknesses across systems, processes and external dependencies.
The goal is to give your organisation a clearer understanding of where supplier risk sits, which vendors require the most attention and what controls should be prioritised.
Frequently Asked Questions
What is third-party risk?
Third-party risk is the security exposure an organisation inherits from vendors, partners and service providers that have access to its systems, networks or data. The risk can come from compromised credentials, insecure technology, poor security practices, data exposure or weaknesses within the supplier’s own supply chain.
Why is supply-chain risk increasing?
Organisations increasingly depend on cloud platforms, managed services, software providers, contractors and other external suppliers. Each relationship can introduce another dependency, access path or data flow. As the number and complexity of these relationships increase, organisations need to understand and monitor the security risks associated with them.
How do you vet a vendor’s security?
Start with risk-based due diligence covering the supplier’s access, data handling, security controls, incident response and subcontractors. Use questionnaires as a starting point, then request supporting evidence such as certifications, assurance reports, testing results and relevant policies for higher-risk suppliers.
How often should you review vendor risk?
Vendor risk should be assessed before onboarding and reviewed throughout the relationship. The frequency should reflect the supplier’s risk and criticality. Reassessments should also occur after significant changes, such as a security incident, ownership change, new technology, new subcontractor or change in how sensitive information is handled.
