Chapter 27 — Suppliers and third parties | Bachelor's Information security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 27 — Suppliers and third parties

Lesson map

Lesson 27 published. Map, example, EX079.

flowchart TD
  N0["Learning outcomes"]
  N1["27.1 Supplier risk"]
  N2["27.2 Proportionate assessment"]
  N3["27.3 Managing access"]
  N4["27.4 Contracts and exit"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX079"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["27.1 Supplier risk"]
  N2["27.2 Proportionate assessment"]
  N3["27.3 Managing access"]
  N4["27.4 Contracts and exit"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX079"]

[Learning outcomes]
    |
    v
[27.1 Supplier risk]
    |
    v
[27.2 Proportionate assessment]
    |
    v
[27.3 Managing access]
    |
    v
[27.4 Contracts and exit]
    |
    v
[Worked example] --> [Exercise EX079]

Learning outcomes

You will (1) identify supplier security risks; (2) assess suppliers proportionately; (3) manage supplier access and contracts.

27.1 Supplier risk

Ashfield relies on suppliers: a core banking provider, a card processor, an IT support company and a cloud email service. Each has access to Ashfield's data or systems, so their security affects Ashfield's. Aisha lists suppliers with the data they handle and the access they hold. She finds the IT support company has permanent remote access to all servers. Dr. Carrow notes that many breaches begin at a supplier with weaker security than its customer. She records each supplier's access and data in a shared register.

27.2 Proportionate assessment

Aisha cannot assess every supplier in depth, so she groups them by risk. Suppliers with access to member data or systems receive a questionnaire and requests for evidence such as certifications. Low-risk suppliers, such as the office cleaning company, receive basic contract terms only. She learns that ISO/IEC 27001 certification can be useful evidence, but only if the certificate's scope covers the services Ashfield uses. She sends questionnaires to the four highest-risk suppliers and records their answers and evidence in the supplier register, noting any gaps for follow-up.

27.3 Managing access

Aisha recommends that the IT support company's permanent access be replaced by access enabled only when a support request is approved, logged and disabled afterwards. The company agrees after a short discussion. She also recommends that supplier accounts be reviewed in the quarterly access review alongside staff accounts. She learns that supplier access is often forgotten because suppliers are not on the staff list. The new arrangement is tested during the next support request, which proceeds without delay, and the supplier's account is disabled again when the work is complete.

27.4 Contracts and exit

Aisha reviews supplier contracts for security terms: protection of data, incident notification, right to audit and return or deletion of data when the contract ends. Two contracts lack deletion terms. She recommends adding them at renewal. She notes that planning exit matters, because changing suppliers without retrieving and deleting data leaves copies in places Ashfield no longer controls. The head of operations adds deletion terms to the renewal checklist. Aisha also suggests that, when a contract ends, Ashfield should request written confirmation that its data have been deleted.

Worked example

Aisha lists supplier access, tiers assessments by risk, replaces permanent support access with approved sessions and adds missing deletion terms.

Synthetic case. Suppliers are synthetic.

Errors and limits

Certification evidence is useful only if its scope covers the services used.

Exercises

EX079 — Permanent access. Which supplier had permanent remote access? Rubric: 3 = the IT support company;; 2 = partly correct;; 1 = other;; 0 = none.
EX080 — Certificate caution. When is ISO/IEC 27001 certification useful evidence? Rubric: 3 = when its scope covers the services used;; 2 = partly correct;; 1 = vague;; 0 = none.
EX081 — Missing terms. What did two contracts lack? Rubric: 3 = data deletion terms;; 2 = partly correct;; 1 = other;; 0 = none.

Continue studying — lesson 27 (chapter 27 of 40)

← Chapter 26 · Course chapter index · Chapter 28 →

Continue to the next authored lesson.