Supplier and third-party cyber risk: what small businesses should check

Where third-party risk comes from

Most small businesses rely on dozens of outside providers. Some hold your data, such as accounting software, payroll services, cloud practice management systems and marketing platforms. Others have access to your network, such as a software vendor that dials in for support, a security alarm company with a remote connection, or a contractor with a login to your server. Each of them is a possible route for an attacker.

Several large incidents in recent years have started with a trusted supplier: an IT management tool compromised and used to push ransomware to many customers, or a software vendor breached and their customers' data taken. Small businesses rarely have influence over big suppliers, but they can control how much they depend on each one and how much access they grant.

Build a supplier list

Start with a list of suppliers that hold personal or confidential information, or have any access to your systems. For each, note what they hold or can reach, how they connect, who in your business manages the relationship and where the contract is. Include small suppliers too; the local technician who set up your server years ago and still has a remote access tool installed belongs on the list. Rank them by impact. A supplier holding all your client records or able to reach your server is high risk. A stationery supplier with your delivery address is low.

Questions worth asking

For high-risk suppliers, ask a few direct questions. Do you use multi-factor sign-in for your staff and for access to our data? Where is our data stored, and is it encrypted? How do you back it up? Who in your company can access our systems, and how is that access logged? How and how quickly will you tell us if you have a security incident that affects us? Large providers usually publish this information in security pages or trust centres, and may hold certifications such as ISO 27001 or SOC 2 reports. Smaller suppliers may answer in an email. Either is fine; the point is to understand the risk, not to run a formal audit.

Limit supplier access

Give suppliers only the access they need, only when they need it. Instead of leaving remote access tools permanently installed, use a support session the supplier requests and you approve. Give each supplier their own named account rather than a shared login, with MFA, so their activity is traceable and you can remove them cleanly. Review supplier access every few months. Remove accounts for vendors you no longer use, and check that remote access tools on your computers and servers are ones you recognise. Unknown remote tools are a common finding during security reviews and a serious risk.

Contracts and privacy

Where a supplier handles personal information on your behalf, you remain responsible for it under the Privacy Act 2020. Contracts should state how the supplier protects the data, where it is stored, that it will only be used for your purposes, how it will be returned or deleted when the contract ends, and how quickly they will notify you of a breach. You do not need a lawyer for every subscription, but for suppliers that hold significant personal information, it is worth reading the terms and asking for changes where they fall short.

When a supplier is breached

Sooner or later, one of your suppliers will tell you they have had an incident. Have a short plan: find out what data or access was involved, reset any credentials shared with them, check your systems for unusual activity, assess whether you need to notify anyone under the Privacy Act, and decide whether to keep using the supplier. Watch for follow-on fraud. After a supplier breach, criminals sometimes use stolen information to send convincing emails to that supplier's customers, such as fake invoices with changed bank details. Remind staff to verify any payment change by phoning a known number.

Keep it proportionate

Third-party risk management in large organisations is a whole department. In a small business, a supplier list, a few questions for the riskiest suppliers, tight control of remote access and an annual review cover most of the ground. An outside review, such as an Office IT health check, can help spot remote access tools or supplier accounts you did not know were there. The aim is to avoid surprises: knowing who has your data, who can reach your systems and what you would do if one of them had a bad day.