With the European Union forecasting that this year will see a four-fold increase in software supply chain attacks in 2021, compared to last year, vendor security has become an enormously important priority for almost every business this year.
On the heels of cybersecurity incidents like the SolarWinds breach and the Codecov cyberattack, we need to relook at our processes; all the way from identifying and onboarding vendors to managing the risks and vulnerabilities their networks pose in the long run.
Supplier due diligence, while once restricted to the scrutiny we undertake at the beginning of our relationships, now extends across the lifetime of our engagements.
With our systems weakened by the impact of COVID-19, the growing sophistication of threat actors, and the increased incidence of cross-border attacks, this is do or die.
Despite how sophisticated modern security technology is, our networks—especially our supply chains—are more vulnerable than ever.
Addressing this in the new normal will require the right resource investments and complete buy-in from your procurement and security teams.
Compliance automation will become a mainstay in VRM strategies
While supplier technology like compliance automation is not necessarily a novel development, what we can expect to see is more and more businesses—even smaller ones—embracing its benefits to bolster supply chain security.
Especially for businesses working with third-party suppliers in different parts of the world, automation will be incredibly useful for ensuring compliance with varying data protection laws.
From the GDPR to the California Consumer Privacy Act, and everything in between, global companies need to ensure that the third parties they work with are complying with relevant regulations.
Leaving aside the obvious operational drawbacks of taking a manual approach to this process, it can also open your business up to significant risks. Staying on top of multiple commitments across a network of suppliers requires the power of automation; with it, you ensure your systems are tracking security and compliance efforts across your supply chain.
Stricter regulations in a post-pandemic environment will mean that any business that wants to operate successfully needs to leverage compliance best practices, which will become a bigger part of supplier due diligence now and in the future.
Ongoing supply chain monitoring will become critical
Even today, many organisations are lulled into a false sense of reassurance they may enjoy with point-in-time assessments.
This, however, is largely inappropriate for a security landscape dominated by a range of risks including ransomware, phishing, and DDoS attacks, to name just a few of the most dominant trends we’re seeing today.
What we need, instead, is real-time monitoring and ratings that are supported by a comprehensive overview of your entire supply chain.
Given the rate at which cyberattacks are launched and the volley of threats our systems are detecting, periodic assessments are no longer able to give us an accurate picture of the risks our data and stakeholders face.
Today, supplier due diligence needs to include a significant component of supply chain monitoring to meet the multi-headed hydra cybersecurity threats have become.
Create dynamic risk profiles that respond to real-time changes
Each vendor brings a different level of risk to the table. This, naturally, means that we can’t afford to take a one-size-fits-all approach to vendor security in the new normal we’re navigating.
Based on how much access your vendors have, the kind of information being shared, and how important their products or services are to your operations, create risk profiles that help you prioritise your mitigation efforts.
Instead of a static profile, however, which often becomes outdated in a matter of days or weeks, make sure your risk profiles are reflecting real-time changes your vendors are making to their policies and practices, as well as the other changes that occur across their own networks.
Adapting supplier due diligence to the new normal is a key responsibility for security professionals
Today, an outdated approach to supplier due diligence can wreak havoc across your supply chain and have disastrous consequences on your finances and reputation.
The number one thing that needs to change is our approach to this process; it’s no longer a one-and-done assessment but an ongoing evaluation that informs your VRM strategies.
