Your suppliers are part of your attack surface
Public bodies depend on software vendors, hosting providers, contractors and integrators. An attacker who compromises a trusted supplier, or abuses the access you granted one, can reach your systems and data. Supply-chain risk must be managed deliberately, not assumed away.
Know and assess your suppliers
Maintain a register of suppliers, what they access or process, and how critical they are to your operations.
Assess security before onboarding, proportionate to the risk, and prefer recognised certifications or independent assurance.
Set security expectations in contracts: controls to maintain, breach-notification duties, data handling, and the right to audit.
Confirm where data is stored and processed, and that it is handled lawfully under the Data Protection Act, 2019.
Limit and monitor the access you grant
Give suppliers only the access they need, for only as long as they need it, through accounts you can monitor and revoke. Require multi-factor authentication for remote and administrative access, and remove it promptly when an engagement ends. Treat a supplier's access with the same care as a privileged internal account.
Plan for a supplier incident
Include suppliers in your incident response plan: know who to contact, what they must tell you and when, and how you would operate if a critical supplier were unavailable. Review your most important suppliers periodically, because a supplier assessed as secure three years ago may not be today.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.