A supplier is an outside organization doing business with an organization and contributing to its supply chain. Track all suppliers, but segment risk metrics by criticality: an apparently low-risk supplier can still contribute to a serious breach. section 5.7.2
Use supplier metrics to identify exposure and direct follow-up:
- Count suppliers and those fully evaluated against defined security and privacy standards; a review backlog may point to resource constraints or a temporary workload increase. section 5.7.2
- Track supplier-related incidents to identify vendors needing more frequent reviews or consideration of alternatives. Incident visibility may be limited when disclosure is not legally required; contracts can specify reporting duties. section 5.7.2
Foodie Fruits
Before adding a vendor for more exotic produce, David checks current suppliers’ cybersecurity performance. He sets targets of 100% compliance with security standards, 90% completion of annual reviews, and 90% audit compliance. Results of 75% review completion and 80% audit compliance suggest a need to investigate gaps and consider added resources or more frequent audits. section 5.7.3
Figure 5.13 On the left, Foodie Fruits’ third-party supply chain risk dashboard indicates problems with delayed compliance and inconsistent adherence to security standards. On the right, the dashboard shows improvements in compliance and adherence to security standards.
Compare the dashboard’s initial supplier compliance problems with its improved results, then investigate remaining gaps rather than treating near-complete compliance as full compliance. section 5.7.3
