Supplier and vendor cyber risk checklist

Your suppliers are part of your cyber risk. When a cloud platform goes down or an IT provider is hacked, your business stops too, and underwriters know it. That is why more application forms now ask who you rely on and how you control their access.

Supplier problems also cause trouble at claim time. A claim for lost income after a supplier outage often depends on paperwork you had to arrange long before the outage. Use this checklist to get that paperwork in place.

Know who you rely on

• List every provider that hosts your systems or data.Include cloud services, software you rent online, data centres and file storage, with the contract on file for each. A supplier register is the evidence underwriters ask for.
• Name the one supplier that would stop you for a week.For example, a travel agency might name its booking platform. Underwriters want to see that you know your weakest link.
• Record what each supplier holds and can reach.Note the data, the systems and the accounts. This speeds up an investigation later.
• Review the list at least once a year.Add new tools as staff start using them.

Control supplier access

• Give your IT provider named accounts with multi-factor authentication.Many forms ask whether third parties use MFA when they connect. A screenshot of the accounts with MFA switched on proves it.
• Limit each supplier to the access it needs.An IT provider that manages laptops rarely needs your finance system. An access review signed by a manager is good evidence.
• Protect your provider's remote management tools with MFA.Attackers use these tools to reach many customers at once. Many underwriters now ask about them directly.
• Remove supplier access within one working day of contract end.An old contractor account is an easy way in for an attacker. Keep a leaver checklist that covers suppliers as well as staff.

Put it in the contract

• Require a written root cause report for every outage.Many policies need a written report from the provider on the cause and length of an outage before they pay a supplier interruption claim. Without a contract right to one, you may never get it.
• Add security and breach notice terms for suppliers handling personal data.Privacy laws in many countries expect a written contract with each processor. Keep a signed copy for each one.
• Check security before you give a new supplier access.A short questionnaire, a certificate such as ISO 27001 or Cyber Essentials, or the supplier's own security statement all help. File what you received.
• Put subcontractors who deliver your work under written agreements.For example, a software firm that outsources testing should cover security and liability in that agreement. Underwriters of technology firms often ask.

Prepare for a supplier outage

• Write down how you would keep working without your key supplier.List a backup supplier, manual steps and contract staff. A continuity plan supports a claim for the extra costs of staying open.
• Check how your policy treats supplier outages.Some policies cover outages caused by attacks only. Others also cover system failure or human error at the provider. Your broker can confirm what your wording says.
• Know the waiting period before income loss cover starts.Many policies pay only once an outage lasts a set number of hours. Compare that number with how long you could cope.
• Understand the limits on wide outages.Many policies exclude regional or global failures of the internet, power or telecoms. Some also apply lower limits when one attack hits many businesses at once.
• Keep supplier status emails and outage notices during an incident.These records show when the outage started and ended. Your finance team needs them to work out lost income.

Broker's tip

Before renewal, ask your three most important suppliers one question: "If you went down, would you give us a written report on the cause and how long it lasted?" A yes in writing, or better still a clause in the contract, can decide whether a supplier claim pays or stalls. Start with the supplier you named as your weakest link.