Chapter 7 — Suppliers and cloud services
Lesson map
Lesson 07 published. Map, example, EX031.
flowchart TD
N0["Learning outcomes"]
N1["7.1 Supplier list"]
N2["7.2 Proportionate questions"]
N3["7.3 The support company"]
N4["7.4 The vendor risk"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX031"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["7.1 Supplier list"]
N2["7.2 Proportionate questions"]
N3["7.3 The support company"]
N4["7.4 The vendor risk"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX031"]
[Learning outcomes]
|
v
[7.1 Supplier list]
|
v
[7.2 Proportionate questions]
|
v
[7.3 The support company]
|
v
[7.4 The vendor risk]
|
v
[Worked example] --> [Exercise EX031]
Learning outcomes
You will (1) list the suppliers that handle firm information; (2) ask proportionate security questions; (3) record what each supplier can reach.
7.1 Supplier list
Daniel lists every outside organisation that stores or can reach Corbridge information: the email and file service, the accounting software vendor, the client portal provider, the payroll service, the support company and a shredding firm. He notes what each holds and how it connects. The support company stands out because it has administrator access to every laptop and the email system. Ms. Ashby explains that a supplier with broad access is part of the firm's security whether or not anyone thinks of it that way, so it belongs in the risk register.
7.2 Proportionate questions
Ms. Ashby advises against sending long questionnaires that small suppliers cannot answer. Instead, Daniel asks each a few questions matched to what they hold: does staff access require a second factor, how quickly will you tell us about a breach, where is our data stored, and what happens to it when the contract ends. ISO/IEC 27002:2022, the guidance on information security controls, includes supplier relationships among its control topics, and Daniel uses it as a checklist for his questions rather than a rulebook, choosing only the items that matter for each supplier.
7.3 The support company
The support company's answers show that its engineers share one administrator account for Corbridge systems. Daniel explains that this makes it impossible to tell who changed what. He asks for named accounts, each with a second factor, and for a monthly list of changes made. The company agrees, after some discussion about cost. Daniel also confirms that the support contract includes a duty to report incidents within one working day. Ms. Ashby notes that clear contract terms give a small firm leverage it would otherwise lack when dealing with a larger provider.
7.4 The vendor risk
Daniel returns to the low-scoring vendor breach risk from chapter three. The accounting software vendor publishes a security summary and holds a recognised certification, which Daniel records. He also checks how the firm would learn of a breach and what it would need to do: tell affected clients and possibly the regulator. He drafts a short plan for that case and files it with the incident procedures. Ms. Ashby observes that planning for a risk outside your control is still useful, because the response is within your control.
Worked example
Daniel lists six suppliers, asks four proportionate questions of each, gets the support company to replace a shared administrator account with named accounts, and plans a response to a vendor breach.
Synthetic case. Suppliers and answers are synthetic.
Errors and limits
Long generic questionnaires often go unanswered and leave the real gaps unknown.
Exercises
- EX031 — Broadest access. Which supplier has the broadest access? Rubric: 3 = the support company;; 2 = partly correct;; 1 = other;; 0 = none.
- EX032 — Four questions. Name two of Daniel's supplier questions. Rubric: 3 = MFA, breach notice, data location, contract end;; 2 = two;; 1 = one;; 0 = none.
- EX033 — Shared account. What problem did the support company have? Rubric: 3 = one shared administrator account;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX034 — Reporting duty. How fast must the support company report incidents? Rubric: 3 = within one working day;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX035 — Vendor plan. Why plan for a vendor breach outside the firm's control? Rubric: 3 = the response is within its control;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 07 (chapter 07 of 12)
← Chapter 06 · Course chapter index · Chapter 08 →
Continue to the next authored lesson.