{"id":18347,"date":"2021-04-07T06:00:50","date_gmt":"2021-04-07T13:00:50","guid":{"rendered":"https:\/\/www.trulioo.com\/?p=18347"},"modified":"2023-08-01T16:25:20","modified_gmt":"2023-08-01T16:25:20","slug":"managing-supply-chain-risk","status":"publish","type":"post","link":"https:\/\/www.trulioo.com\/blog\/business-verification\/managing-supply-chain-risk","title":{"rendered":"Managing supply chain risk: the due diligence is in the details"},"content":{"rendered":"\n
\"Managing<\/figure>\n\n\n\n

<\/span><\/p>\n\n\n\n

Accellion. SolarWinds. Microsoft Exchange. Until 2021, most of these names were familiar to many organizations as parts of a whole: pieces of the supply chain, providing services that supported day-to-day operations.<\/span><\/p>\n\n\n\n

Now, they\u2019ve become better known as some of the biggest third-party breaches in recent history, allowing bad actors access to the systems and proprietary information of thousands of organizations worldwide.<\/span><\/p>\n\n\n\n

These events highlight the need (now more than ever) for organizations to be more proactive with their supplier risk management.<\/span><\/p>\n\n\n\n

Some context for supplier breaches<\/b><\/h2>\n\n\n\n

As of 2017,<\/span> the average company had 181 suppliers<\/span><\/a> access their network each week.<\/span> In 2018, <\/span>Ponemon Institute<\/span> found that 59% of companies had experienced a third-party data breach<\/a>, but only 16% of companies thought they were effectively mitigating third-party risks. In 2020, research indicated that<\/span> 43% of third-party relationships<\/span><\/a> never see any kind of due-diligence checks.<\/span><\/p>\n\n\n\n

With this sort of negative data, it\u2019s easy to understand the environment that makes suppliers look so very tempting to bad actors. Hacking the NSA and Microsoft would be time-consuming and challenging, but both organizations have an immense network of suppliers that expose them to risk. Even if every direct supplier were completely secure (which is unlikely), each of those suppliers has their own suppliers. And among those, some will be vulnerable to attack.<\/span><\/p>\n\n\n\n

Hackers, like businesses, look for efficiencies. In the cases we saw in early 2021, <\/span>hackers got into the systems<\/span><\/a> of three widely-used suppliers, and that in turn gave them access to multiple high-profile targets.<\/span><\/p>\n\n\n\n

Supplier risk management<\/b><\/h2>\n\n\n\n

Like many things in business, there\u2019s no such thing as zero risk. In the vast majority of cases, to run a business, suppliers are necessary, from data hosting, to the shop that customizes giveaway pens.<\/span><\/p>\n\n\n\n

The only solution is to manage the risk. According to the Association for Supply Chain Management<\/a>:<\/span><\/p>\n\n\n\n

\n

Understanding who your critical first tier suppliers are should be the absolute bare minimum, and that starts with defining objective criteria to evaluate what makes a supplier critical in the first place.<\/p>\n<\/blockquote>\n\n\n\n

At a high level, the key steps in supplier risk management are:<\/span><\/p>\n\n\n\n

Identification<\/b><\/p>\n\n\n\n