Skip to content
sec/atlas
back to the map
practice
stage: identify
2 min read

Third-party and supply chain risk

A growing share of incidents enter through a vendor, a partner or a dependency: an attacker breaches a smaller company to reach its large customer. Know who you depend on and how much you trust them.

vendor risk questionnaires (SIG, CAIQ)security ratings servicesSOC 2 and ISO 27001 reportsSBOMscontract security clausesvendor inventory

Why it matters

Every vendor with access to your data, systems or code extends your , and you cannot patch their servers. The risk covers software suppliers and their dependencies, cloud and SaaS providers, outsourced services with network access, and partners who integrate with your systems. Regulators and customers increasingly hold you accountable for the data you give a supplier.

The lifecycle

  • Inventory: a living list of every third party, what they do, what data and access they have and who owns the relationship.
  • Tier by criticality: the depth of review should match the impact if the vendor fails or is breached (sensitive data, production access, business dependence).
  • Due diligence before signing: questionnaires, certifications and audit reports, security ratings, and for critical vendors a deeper review or a technical test.
  • Contract: security requirements, breach notification time, right to audit, data handling and deletion, subcontractor rules, exit terms.
  • Onboarding with : the minimum access, time-limited, with named accounts and monitoring.
  • Ongoing monitoring: reassess on a schedule by tier, watch for incidents and ratings changes, review access.
  • Offboarding: revoke access and confirm data return or deletion.

A tiering rule

vendor-tiering.ymlyaml
tiers:
  critical:   # a breach or outage here hurts the business directly
    criteria: [processes personal or payment data, has production or network access, no easy substitute]
    review: [full questionnaire, SOC 2 Type II or ISO 27001 report, architecture review, annual reassessment]
  important:
    criteria: [handles internal confidential data, integrates through APIs]
    review: [standard questionnaire, certification check, reassess every two years]
  standard:
    criteria: [no sensitive data, no integration]
    review: [lightweight check at onboarding]

vendors:
  - { name: ExamplePay,     tier: critical,  owner: finance-eng, data: [payment tokens] }
  - { name: ExampleSurvey,  tier: standard,  owner: marketing,   data: [] }

Software supply chain

  • Maintain an for what you ship and ask critical suppliers for theirs.
  • Scan dependencies continuously and pin versions; verify signatures on what you install.
  • Review the vendor's own security practices, such as how they sign releases and respond to vulnerabilities.
  • Plan for failure: (everything on one provider), exit plans and backups outside the vendor.
Attack surfaceEverything exposed to untrusted input: endpoints, forms, dependencies, ports, pipelines. A minimal surface is a defense strategy.see in glossary →Least privilegeleast privilegeThe principle of giving each identity only the permissions strictly needed for its function, and nothing more. It is the opposite of 'admin user by default': every extra role is one more path an attacker can use after a compromise.see in glossary →SBOMThe software's ingredient list: dependencies, versions, licenses and hashes, in a standard format.see in glossary →Concentration riskExcess dependence on one supplier, provider or technology, so that its failure becomes your failure.see in glossary →

connections on the map

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Study before

test what you learned

Loading questions…