| Supply chain security is the work of managing the cyber risks introduced by the suppliers, software and services your business relies on. It covers the access they hold, the information they handle, the dependencies behind their service and what you do if something goes wrong. |
A supplier incident can expose records, interrupt a service or create a route into your systems. The impact depends on the relationship and the controls in place, and knowing those relationships helps you decide where to limit access, ask further questions or prepare another way of working.
Every business now depends on outside providers for its IT support, accounting, payroll, bookings and communications. That reliance is normal and useful. The aim is not to distrust every supplier, but to understand which ones could cause real harm if something went wrong, and to put proportionate checks and fallbacks in place.
This guide explains what supply chain security covers, how supplier incidents can affect your business, which suppliers deserve closer attention and what to do if one of them is breached.
What is supply chain security?
Supply chain security is how a business manages the cyber risk carried by the suppliers, software and services it depends on. In this guide the term means digital suppliers, not the physical security of goods and freight.
Your digital supply chain includes the obvious names, such as your cloud provider and your managed IT partner. It also includes the payroll system, the online booking tool, the marketing platform and the smaller applications that hold a slice of your business data or support a daily task.
It covers software as well as relationships. Supplier relationships, where software comes from, the components it is built on and how updates are delivered all overlap with vulnerability management. A flaw in a product and a malicious update are different problems, but either can reach your business through a supplier, so the two disciplines support each other.
How can supplier incidents affect your business?
A supplier incident can affect your business through the access it holds, the data it keeps, the software it delivers or the service you depend on. Which of these matters depends on the relationship.
- Access. A supplier may use administrator accounts, remote support tools or an application connection to do its job. Those permissions should have an owner, an agreed purpose and a review point, because access that outlives its purpose is easy to forget.
- Data. A payroll provider, booking platform or marketing service may hold information without ever accessing your network. Its breach may affect the records it holds even if your own systems remain intact, and good NZ Privacy Act compliance treats information a supplier processes for you as part of your own responsibility.
- Software. A compromised update or dependency can introduce risk into an application you already trust.
- Availability. A supplier outage can stop essential work without any data being touched.
Supply chain security therefore includes both supplier relationships and the technology delivered through them.
Which suppliers need closer attention?
Prioritise the suppliers whose failure or compromise would cause the greatest harm. Consider privileged access, sensitive information, essential services, the difficulty of replacing the provider and any important subcontractors behind the service.
The five factors in the graphic are illustrative examples of priority, not fixed labels for whole supplier types. A supplier can matter because of what it does for you, not only what it can access. A simple list is enough to start, and for each supplier it should record:
- Service. What the supplier does and which business activity depends on it.
- Access and data. The accounts, connections and information it holds.
- Owner. The person in your business responsible for the relationship.
- Contacts and review. The incident contact and the next review date.
- Fallback. How the work continues if the service stops.
Low spend does not mean low impact, and limited data access does not mean a supplier is unimportant. This supplier view sits inside the wider IT risk management process, where owners are assigned and risks are accepted or treated, rather than apart from it.
How do you build supply chain security step by step?
You build supply chain security in four practical steps: map your supplier dependencies, check suppliers before you engage them, limit and review their access, and plan for an incident and for the end of the relationship. None of the four needs enterprise tooling to start.
The graphic is a starting framework. Mapping covers access, data and service dependencies, and the review continues for the life of each relationship rather than ending once a supplier is engaged.
Map your supplier dependencies
List the suppliers that can reach your systems, hold your data or provide a service your work depends on. For each one, note the access, the information and what would stop if the service stopped. Include the quiet ones, such as a bookkeeper who logs in from home or a web developer who still holds access from an old project.
Check a supplier before you engage it
Use the questions below in proportion to the supplier’s priority, and record who follows up anything left unanswered. This is a relationship review, not a certification.
Limit and review the access suppliers hold
Give each supplier the access it needs to do the job and no more. Remove standing access that is no longer used, prefer named accounts to shared logins and ask how both human accounts and automated connections are protected. Named accounts help with attribution where suitable logs exist, although they do not prove who used a compromised account.
Plan for an incident and for the exit
Agree in advance who coordinates a supplier incident, how you will confirm it and what the fallback is if the service is unavailable. Plan the end of the relationship too: how data is exported, returned or disposed of, and how the supplier’s access and connections are removed.
For step two, the National Cyber Security Centre’s supply chain guidance sets out the same map, prioritise and manage approach in more depth. These are the questions to ask:
| Ask about | What to establish |
|---|---|
| Service and ownership | Which business activity depends on the supplier, and who owns the relationship internally. |
| Access | Human accounts, privileged access, application connections, their purpose and approval, and how access is reviewed. |
| Information | What data is held, where it is processed, permitted uses, retention and any relevant subcontractors. |
| Security responsibilities | Which controls each party operates, including supported authentication, updates, monitoring and reporting. |
| Assurance | What supports the supplier’s claims, and whether any certification applies to the service you actually use. |
| Incident contact | A trusted contact route, notification arrangements and the information needed to assess an incident. |
| Recovery and exit | Available exports, recovery arrangements, continuity options and how access and data are handled when the service ends. |
Clear written answers and a certification such as ISO/IEC 27001 can support a review, but neither proves a supplier cannot be breached. Check that any certificate covers the service you actually use. A missing certificate or a supplier that limits what it discloses is a reason to ask further questions, not proof of poor security. The NCSC’s August 2026 guide on keeping personal information safe with suppliers also covers contractual responsibilities and ongoing oversight.
How do you keep supplier reviews active?
Set the review frequency around the exposure and the pace of change, so higher-risk relationships get more frequent checks. Review promptly when:
- Access changes. New accounts, new connections or wider permissions.
- The supplier changes. A new subcontractor, a changed service or a change of ownership.
- An incident occurs. At the supplier or in your own systems.
- The relationship ends. A project finishes or the contract is not renewed.
Follow up unresolved answers and agreed actions. When a supplier leaves, remove the access and connections it no longer needs, arrange the required data return or disposal and check that the remaining services can operate without it.
What should you do when a supplier is breached?
Confirm the incident through a contact route you already trust, then work through the response in order. Do not assume every customer or system is compromised.
- Establish the scope. Identify which service, information or access may be affected and appoint a response coordinator.
- Contain the exposure. With your IT and incident-response contacts, preserve records and suspend connections, revoke access or rotate credentials as needed. Check application sessions and integration credentials as well as passwords, because resetting a password alone may not end an attacker’s access.
- Assess notification. Assess the personal information involved and the risk of serious harm. Where a breach is notifiable, the Privacy Commissioner’s privacy breach guidance expects you to notify the Commissioner and affected people as soon as you are practically able.
- Use the fallback. A backup does not automatically recreate an unavailable cloud application, so check how exported or restored records can be used. Consider what critical work stops if a service is disconnected.
Identify which organisation is responsible. Where a supplier processes information only on your behalf, the Commissioner’s guidance on working with third-party providers treats your business as holding it, and generally expects notifiable breaches to be reported within 72 hours of the breach becoming known. Do not wait for a complete supplier report if the threshold is already met. Record decisions, outstanding questions and the conditions for reconnecting.
How is supply chain security different from your other cyber measures?
Supply chain security focuses on the relationships and dependencies that sit outside your direct control. Other measures look at different questions, and they work together.
IT risk management assigns owners and decides which technology risks to accept or treat. A security audit reviews controls against agreed criteria within a defined scope, and a cyber security assessment examines your environment and can include supplier dependencies if they are scoped in. Vulnerability management finds and addresses known weaknesses in the systems it covers.
Supply chain security support from Exodesk
Exodesk can help review supplier access and technical dependencies and implement agreed changes, while your business keeps the supplier-selection and risk decisions. The scope identifies the suppliers and systems covered, the checks to carry out, the changes required and any ongoing review or monitoring, so agree those inclusions rather than assuming every supplier review is part of an existing IT support fee.
Exodesk has supported New Zealand businesses since 1989. Today, our Christchurch and Dunedin teams support businesses nationwide.
NEXT STEP
Concerned about a supplier’s access or a service you depend on?
Tell us which supplier, connection or dependency concerns you and what it supports, and we can discuss the work required. Please keep passwords, personal records and confidential supplier documents out of the initial enquiry.
Or see our cyber security services.
Frequently Asked Questions
What is supply chain security?
Supply chain security manages the cyber risks arising from the suppliers, software and services your business depends on. It covers access, information handling, software dependencies, service continuity and response arrangements. A supplier incident does not automatically compromise every customer.
Why does supply chain security matter for small businesses?
A small business can rely heavily on one IT provider, cloud application or specialist service. A supplier incident may affect records or stop important work. Map those dependencies and use controls and fallback arrangements proportionate to the potential harm.
How does supply chain security differ from vulnerability management?
Supply chain security considers suppliers, products, dependencies and their lifecycle. Vulnerability management identifies and addresses known weaknesses in systems and software. They overlap where a component or product from a supplier creates an exposure, and neither replaces the other.
How do we check a supplier before signing?
Ask about access, data use, subcontractors, security responsibilities, incident reporting and recovery. Review the answers against the service you need and follow up gaps. Certification can help, but clear answers and a certificate are not a guarantee of security.
Which suppliers need closer attention?
Start with privileged access, sensitive information and services essential to operations. Consider how difficult the supplier would be to replace and any shared dependencies. Priority follows possible business harm, not spending or access alone.
What is third-party risk?
Third-party risk is the possibility of harm arising from an outside organisation your business relies on. Cyber compromise is one part, and availability, service delivery, privacy and other obligations can also matter. Supplier cyber security addresses the digital security part of that wider risk.
How frequently should vendor access be reviewed?
Set a schedule according to the exposure and the rate of change. Review sooner when responsibilities, systems or permissions change, after an incident and when a project or contract ends. High-risk access should not wait for a routine annual review.
What should we do if a supplier is breached?
Confirm the incident through a trusted contact, establish the affected data and access, coordinate containment and preserve relevant records. Check sessions and application connections as well as passwords. Assess notification duties and use an agreed fallback where the service is unavailable.
Are we responsible when a supplier has a privacy breach?
Where a supplier processes information only on your behalf, your organisation keeps the relevant responsibilities. Reporting roles can differ where the supplier also uses the information for its own purposes. A breach is notifiable when serious harm is caused or likely, so identify the responsible agency and act as soon as practicable.
How much does managing supplier cyber risk cost?
Cost depends on the suppliers, information, access, checks and changes required. An initial supplier list can be simple, while technical reviews, remediation and monitoring need an agreed scope. Confirm what existing support covers and what is quoted separately.
Contact us or call 0800 396 337 to talk through a supplier, connection or dependency that concerns you.
