01 · Cybersecurity and Infrastructure
Third-Party and Supply Chain Risk
Your suppliers hold your data and reach your systems. This is how you keep that safe.
Cybersecurity and Infrastructure
Third-Party and Supply Chain Risk
Your suppliers hold your data and reach your systems. This is how you keep that safe.
Showing 1 of 10
- 1Inventory suppliers
- 2Tier by impact
- 3Assess
- 4Contract properly
- 5Monitor and review
What We Do for You
- Build the register of who has access to what.
- Assess each supplier against a proportionate standard.
- Get security and breach-notice terms into the contracts.
- Monitor critical suppliers between reviews.
- Handle a supplier breach with a written plan.
How this is bought: Bought as an assessment first, then a project priced from what the assessment finds. Build an estimate for your case.
Our Approaches Explained
Supplier inventory and tiering
Ranking suppliers by the damage a failure at their end would cause.
Proportionate due diligence
A short questionnaire for low risk, evidence review for critical suppliers.
Contractual security terms
Breach notification windows, right to audit, data location and deletion on exit.
Fourth-party awareness
Knowing who your suppliers depend on in turn.
Continuous monitoring
Watching for breaches and posture changes at critical suppliers.
The Standards We Work To
ISO/IEC 27036 supplier relationshipsNIST SP 800-161 supply chain riskSOC 2 report review practice
We follow the structure and controls these standards describe. We do not claim to be certified against them - where you need a formal certificate, we prepare the evidence and an accredited body performs the audit.
What You Get
- Supplier register with tiers
- Due diligence pack
- Contract clause set
- Monitoring arrangement
- Supplier incident plan
Suppliers tiered by impact95%
Critical suppliers assessed91%
Contracts carrying breach-notice terms88%
These are the areas clients most often ask us to improve. Your project sets its own targets, measured and agreed with you.