Risks in the supply chain

Suppliers can pose various risks to an organisation’s cyber security through

Data breach

Back door attack

All of these answers

Phishing

From the UK Governments Cyber Security Breaches Survey for 2022, what percentage of non-financial services and communications businesses or charities are taking steps to formally review the risks posed by their immediate suppliers?

28%

7%

13%

34%

DORA is an EU Regulation and will impact UK Businesses

Only organisations that form part of an affected EU organisation's supply chain

In its entirety

Not at all

Financial Services sector only

In our approach to Supplier Relationship Management, we should

All of these answers

Ensure that all contracts are recorded in a Contracts Register

Establish who are our main supply partners

Ensure that the suppliers have a robust attitude to business continuity and security and have a robust approach to how they manage their own supply chain risks

Unauthorised subcontracting may contribute to

Better governance

Improved profitability

Greater assurance

Quality and ethical issues

Securing the supply chain is designed to deliver

Reduced payroll costs

Improved labour relations

Reduced digital risk associated with this activity

None of these answers

Dependent on the maturity of the function we would expect to be able to verify that

All of these answers

It will have systems and processes in place to monitor the financial health of its key suppliers

The organisation will have put in place processes to ensure that there is a consistent approach to engaging with key suppliers ensuring that lines of communication are established, used, encouraging two-way dialogue and remain open

It will have considered its supply chain risk and developed a supply chain strategy that is maintained

To combat unauthorised subcontracting the due diligence process should include consideration of

Ensuring the supplier is ISO9001 Certified

Establishing capacity of the supplier

Limiting the length of the supply chain

Ensuring that the organisation is ISO27001 Certified