Chapter 22 — Security governance, risk and compliance: data and dependencies
Lesson map
Lesson 22 published. Map, example, EX064.
flowchart TD
N0["Learning outcomes"]
N1["22.1 Supplier dependencies"]
N2["22.2 Tiering"]
N3["Lab — Supplier tiering by data, criticality and remo"]
N4["22.3 Proportionate controls"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX064"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["22.1 Supplier dependencies"]
N2["22.2 Tiering"]
N3["Lab — Supplier tiering by data, criticality and remo"]
N4["22.3 Proportionate controls"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX064"]
[Learning outcomes]
|
v
[22.1 Supplier dependencies]
|
v
[22.2 Tiering]
|
v
[Lab — Supplier tiering by data, criticality and remo]
|
v
[22.3 Proportionate controls]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX064]
Learning outcomes
You will (1) map dependencies on suppliers; (2) tier suppliers by risk; (3) set proportionate supplier controls.
22.1 Supplier dependencies
Elmfield depends on suppliers for its housing system, email, payroll, repairs and printing. Sofia maps what each supplier accesses: data, systems or premises. She learns that NIST CSF 2.0 includes cybersecurity supply chain risk management in its Govern function, and that ISO/IEC 27002:2022 covers information security in supplier relationships. Small organisations depend heavily on suppliers, so their security often depends on suppliers' controls as much as their own. The repairs contractor's remote access to the housing system shows how a supplier's controls become part of Elmfield's own exposure.
22.2 Tiering
Sofia scores five suppliers from zero to two on three factors: access to personal data, criticality to services and remote access to systems. The lab adds the scores and assigns tiers. The repairs contractor and cloud email score five, high tier. The payroll bureau scores four, also high. The printing firm scores one and the cleaning company zero, both low. Tiering lets Elmfield focus scrutiny on the three high-tier suppliers rather than treating all suppliers alike. The scores also explain the tiers: the payroll bureau reaches four through personal data and criticality even without remote access.
Lab — Supplier tiering by data, criticality and remote access
"""Supplier tiering: data access, criticality and remote access scored 0-2 (synthetic)."""
sup = {"repairs contractor": (1, 2, 2), "payroll bureau": (2, 2, 0), "cloud email": (2, 2, 1),
"printing firm": (1, 0, 0), "cleaning company": (0, 0, 0)}
for s, (d, c, r) in sup.items():
t = d + c + r; tier = "high" if t >= 4 else "medium" if t >= 2 else "low"
print(f"{s}: score {t} tier {tier}")
Run with python3 lab_tier.py. Verified output:
repairs contractor: score 5 tier high
payroll bureau: score 4 tier high
cloud email: score 5 tier high
printing firm: score 1 tier low
cleaning company: score 0 tier low
22.3 Proportionate controls
For high-tier suppliers, Sofia recommends security questions before contracts, contract clauses on breach notification and data return, and an annual review of their assurance reports or certifications. For low-tier suppliers, a short confidentiality clause suffices. She notes that the repairs contractor's remote access needs particular attention, since its staff connect to the housing system from their own offices. She learns that proportionate supplier governance saves effort while focusing on real risk. Requiring the repairs contractor's staff to use named accounts would also support the contractor misuse controls chosen later.
Worked example
Sofia maps supplier access, tiers five suppliers with three high-tier and sets proportionate controls.
Synthetic case. Suppliers and scores are synthetic; CSF 2.0 and ISO/IEC 27002:2022 are real.
Errors and limits
Simple scores miss nuance. Supplier assurance reports vary in scope.
Exercises
- EX064 — Tiering factors. Which three factors are scored? Rubric: 3 = personal data access, criticality, remote access;; 2 = three;; 1 = vague;; 0 = none.
- EX065 — High tier. Which suppliers are high tier? Rubric: 3 = repairs contractor, cloud email, payroll bureau;; 2 = three;; 1 = printing;; 0 = none.
- EX066 — High-tier controls. Name two controls for high-tier suppliers. Rubric: 3 = pre-contract questions and breach notification clauses;; 2 = controls;; 1 = vague;; 0 = none.
Synthesis
Tiering suppliers focuses scrutiny where dependencies carry real risk.
Continue studying — chapter 22 of 40
← Chapter 21 (draft) · Course chapter index · Chapter 23 (draft) →