Optimizing Supplier Cyberrisk Assessment

Cyberattacks targeting suppliers have become increasingly common, with a number of high-profile cases drawing significant attention in recent years. While it is commonly believed that major threats come from information and communication technology (ICT) suppliers, attackers can also target smaller vendors as an entry to better-protected organizations. Cyberincidents in the supply chain are not solely the result of cyberattacks. Significant unintentional risk also arises from supplier employee errors or defective supplier hardware or software, which can critically impact an organization’s services, as was the case for the 2024 Crowdstrike failure.¹ Attacks through the supply chain are rapidly growing and tend to compromise larger volumes of confidential data than other cyberattacks. An analysis of 1,397 cyberincidents from 2000 to 2020 found that suppliers were directly or indirectly responsible for 18% of them.²

While major cybersecurity frameworks such as the US National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) 2.0, International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 27001:2022, and the EU Digital Operational Resilience Act (DORA) address the management of cyberrisk in the supply chain, guidance is often high-level and requires significant expertise.³ It may also be too cost-prohibitive for small and medium-sized enterprises (SMEs), which are more likely to face resource constraints. Most academic research focuses on technical solutions, standards, protocols, supplier cyberrisk characteristics, or the financial impact of cyberincidents in the supply chain. Studies analyzing how organizations approach cyber supply chain risk management (C-SCRM) are scarce due to data sensitivity and the fact that many organizations do not fully understand cyberrisk beyond their direct supplier; that is, the network of their suppliers’ suppliers (figure 1).

To better understand how various organizations assess supplier cyberrisk in practice, which contextual factors impact the maturity of the process, and how effective the process is at identifying risky suppliers, the authors interviewed 33 security experts in charge of C-SCRM and surveyed 53 security experts. Their findings informed this article.

The Participants

The 33 interviewees included cybersecurity professionals, chief information officers (CIOs), chief information security officers (CISOs), IT managers, vendor managers from 18 for-profit and government organizations, and 10 consultants who provide supplier risk assessments to various clients. In addition, 53 experts with an average of 11 years of cybersecurity experience were surveyed. Participants came from various countries (Australia, China, Europe, Israel, New Zealand) and industries.

Cyberrisk Assessment: The Ideal vs. the Reality

The proposed supplier cyberrisk assessment process was developed based on prior literature, established standards and frameworks, and the analysis of the interviews and survey data. The process can be integrated with the steps of organizational cyberrisk assessment, as outlined in ISO/IEC 27005:2022 or NIST Special Publication (SP) 800-30, including risk assessment (identification, analysis, evaluation), risk mitigation, and monitoring.⁴ Figure 2 illustrates how the steps of this process can be applied in organizations. The effectiveness of supplier assessment and management relies on following every step in the sequence chronologically, rather than allocating extra resources to some steps while overlooking others. The interview and survey participants shed light on how the process is applied in practice.

Source: Slapnicar; et al.; “Process Theory of Supplier Cyber Risk Assessment,” Australasian Journal of Information Systems, 2025

Cyberrisk Assessment in the Selection Process

The supplier cyberrisk assessment process consists of two phases: assessing cyberrisk during the selection process and assessing and managing supplier cyberrisk after onboarding. To assess cyberrisk during the selection process, enterprises should:

1. Identify suppliers. Comprehensive identification of suppliers is crucial. Challenges include shadow IT (the unauthorized use of applications or cloud services by employees) and a lack of central procurement processes and supervision. Mandating a software bill of materials (SBOM), as required by the US Federal Government for software supplied to federal agencies (per the 2021 Executive Order on Improving the Nation’s Cybersecurity), would aid in identifying all software components.⁵ However, this practice was not observed in the organizations interviewed. Mature organizations address the challenges by educating employees about data risk and implementing technical blocks. Typically, only first tier suppliers are identified and assessed for cyberrisk, while the identification and assessment of their suppliers are largely lacking.
2. Assess supplier criticality. Organizations evaluate suppliers based on their criticality to business processes, data sensitivity, and IT integration. Critical suppliers are those whose disruption could significantly impact the organization. Criticality then defines the scope and depth of the supplier risk assessment. The scope refers to the number of assessment methods and the range of supplier risk characteristics examined. The depth pertains to the level of assurance required. Many organizations scrutinize only critical suppliers.
3. Employ a supplier risk assessment method, such as: 
   • General due diligence—Review financial, operational, and strategic risk of a supplier using public information and annual reports. If a supplier is deemed non-viable due to any such risk, it should not be assessed for cyberrisk.
   • Cybersecurity due diligence—Use public information, threat intelligence, and scans of the supplier’s outward-looking technology vulnerabilities.
   • Questionnaires—Collect detailed information about supplier characteristics. Questionnaires are divided into sections that assess the common core controls applicable to all suppliers and sections tailored to suppliers that provide specific critical services. They can be self-made or provided by a third party. Although suppliers' maturity in specific controls can vary significantly, most organizations do not capture this variation because their checklists only allow for “yes” or “no” responses. Only the most advanced organizations or those that rely on specialized third parties for assessments use a maturity scale for each question resulting in a quantitative score.
4. Evaluate supplier cybersecurity posture. All three assessment methods aim to assess the key characteristics of a supplier, which include technology controls, processes, people, regulatory compliance, past incidents, supply chain complexity, foreign ownership, the supplier’s reputation, and whether a supplier is an attractive target. The interviewees and survey respondents indicated that technology controls are still the most critical characteristic of cybersecurity posture. Focal organizations also assess a supplier’s reputation and employee awareness programs.
5. Decide whether assurance measures should be taken. Whether an organization requires assurance depends on the supplier’s criticality. The interviews conducted by the authors revealed that only critical suppliers are required to provide audit reports, pen tests, or cybersecurity certifications; for less critical suppliers, organizations rely on trust and transparency.
6. Determine the supplier’s cyberrisk level. Synthesizing the diverse information from extensive questionnaires and due diligence reports into an overall supplier risk level can be challenging. Organizations compare the information obtained from suppliers with public sources and threat intelligence for consistency. It is important to understand that the supplier's criticality determines the potential impact of a cyberincident involving the supplier, whereas a supplier's risk posture helps evaluate the likelihood of a cyberincident involving a supplier. However, in practice, most organizations do not separately assess impact and likelihood. Instead, they derive an overall supplier risk level as a subjective summary of various qualitative pieces of information, typically categorized as high, medium, or low.

Based on the assessed cyberrisk level, security experts recommend to the executive managers whether a supplier should be onboarded. If the risk level is low, the supplier is offered a contract with detailed cybersecurity requirements. For medium risk levels, and if a supplier is beneficial from a business perspective, organizations typically do not reject the supplier outright but use the assessment to identify missing controls and work with the supplier to improve its security posture. If the risk level is high, assessors recommend rejecting the supplier, although management may not always follow this advice.

Cyberrisk Assessment and Management After Onboarding

The second part of the supplier cyberrisk assessment takes place after onboarding. During this stage, organizations should:

1. Uplift supplier security posture. When a supplier is important to an organization for business reasons but fails to meet certain security requirements, the organization often engages in uplifting the supplier’s cybersecurity posture. Organizations tend to be more lenient if the suppliers are not involved in critical processes. They typically onboard such a supplier but include requirements in the master agreement to implement the missing controls in accordance with a specific timeline and roadmap. They also provide support, such as conducting joint vulnerability assessments.
2. Review monitoring methods and frequency. Because of the static nature of initial risk assessments, organizations should regularly monitor their suppliers' security posture and ensure ongoing compliance with security requirements. Methods include regular assessments, audits, and integrating threat intelligence with the focal organization’s systems. The findings indicate considerable variation in the maturity and frequency of monitoring practices. For critical suppliers, organizations periodically verify contract compliance, hold face-to-face meetings, or require audit reports and penetration tests. For noncritical suppliers, performance reviews and security checks are typically conducted only at the time of contract renewal. Larger organizations are beginning to exercise their right to audit, but this is not yet a widespread practice. Only the more advanced organizations continuously monitor critical suppliers by integrating threat intelligence with their systems. Interestingly, apart from German banks, no organization was found to monitor the three leading US cloud providers due to the power imbalance between the providers and the organizations they serve. German banks conduct onsite audits of these critical cloud providers as German prudential regulations mandate it, and they do so in consortium with other banks.⁶

Not all parts of the assessment process are equally mature across organizations. For example, some organizations might have a thorough identification and assessment procedure, especially for new suppliers, but lack monitoring after onboarding. Some organizations, on the other hand, might conduct continuous monitoring of their existing suppliers, but do not have a comprehensive identification and selection process in place.

Which Factors Determine the Maturity of Supplier Cyberrisk Assessment?

The maturity of C-SCRM largely varies among organizations and is affected by several factors—characteristics of the focal organization. Consider size and regulation, which shape an organization’s risk culture and resource allocation to cybersecurity. Larger organizations have more complex supply chains and broader assessment scopes, often assessing more than just critical suppliers. In the financial industry, supplier classification, risk assessment, and monitoring are subject to strict oversight, such as what is imposed by DORA in the European Union.⁷ Critical infrastructure regulation also leads to higher maturity of C-SCRM. However, in some (public sector) organizations, the price and service quality of a supplier may still outweigh its cyberrisk during supplier selection. Regulated, larger organizations typically also have stronger IT governance with more resources, strong leadership support, and experienced security staff, leading to continuous development of risk assessment and monitoring methods.

Another factor that can provide leverage is pooling resources within the industry by sharing costs, expertise, and information related to risk assessments. This collaborative approach is particularly effective for auditing large common suppliers. Such practices were observed not only in German banks but also in Australian schools, according to the research conducted by the authors.

The cost-benefit approach ultimately determines the maturity of the C-SCRM. Allocation of resources to this area is proportional to the perceived cyberrisk exposure and the benefits of managing the risk. If cyberincidents in the supply chain have never occurred and are seen as highly uncertain and uncontrollable, the perceived benefits of allocating resources may also seem uncertain. While the interviewees showed an awareness of risk and how to manage it, they also expressed frustration with the extensive scope and uncontrollability of the risk factors.

What Can Cybersecurity Experts Do to Enhance Supplier Cyberrisk Assessment Maturity?

Enhancing the maturity of supplier cyberrisk assessment requires more than just awareness—it demands actionable strategies. Drawing on insights from interviews with cybersecurity professionals, CIOs, CISOs, and vendor managers across diverse industries and regions, practical steps have been identified that organizations can take to improve their C-SCRM practices. These recommendations reflect both the challenges and solutions observed in the field and are intended to guide organizations toward more robust, scalable, and integrated assessment processes:

1. Optimize resources. A lack of resources remains a challenge. Pool resources with other organizations using the same suppliers for cyberrisk assessments and other operational and strategic risk assessments (such as environmental, social, and governance [ESG] risk).
2. Improve objectivity. To lessen reliance on expert judgment, build a database of suppliers’ characteristics to enable benchmarking and validation of the assessment’s methods. This can help verify whether suppliers assessed with higher or lower risk scores are truly more or less risky. Refine the measurement scales of risk and develop a scoring system.
3. Integrate supplier cyberassessment with other cyberrisk assessments. The likelihood of a supplier experiencing a cyberincident and the likelihood of that incident impacting an organization are not necessarily proportional. The impact on an organization depends on the effectiveness of its own controls and the specific processes the supplier is involved in. Supplier cyberrisk assessment should be integrated with the overall cyberrisk assessment process in an organization, following the logic of ISO/IEC 27005 or NIST SP 800-30 guidelines.
4. Make suppliers accountable for their cybersecurity by requiring self-attestation. This approach shifts accountability to suppliers and ensures better protection for an organization. Currently, self-attestation services are still in the early stages. Without such optimization, regulated industries with stringent assessment requirements may struggle to engage small and micro suppliers, who might find it challenging to meet the increasingly demanding regulatory requirements.
5. Outsource assessments. Consider outsourcing cyberrisk assessments to increase their effectiveness and optimize resources. Moreover, specialized third-party providers maintain extensive databases of suppliers, enabling the assessment of second- and third-tier suppliers in the supply chain and the development of predictive models for cyberrisk. When utilizing vendor management platforms, ensure that these assessments are comprehensible and align with enterprise cyberrisk assessments.

Conclusion

This research was conducted to address a critical gap in understanding how organizations assess and manage cyberrisk in their supply chains. The interviews, complemented by survey data, provided rich insights into the real-world practices—and challenges—in supplier cyberrisk assessment. The findings reveal that while many organizations have adopted some form of supplier risk assessment, the maturity of these processes varies widely. The recommendations are grounded in these empirical insights and offer actionable strategies for enhancing assessment maturity. By implementing them, an organization can significantly enhance its supplier cyberrisk assessment and management. The outcome of supplier assessment and management requires the sequence of steps to be followed in order, rather than applying more resources to some steps while neglecting others.

If organizations fail to implement these recommendations, they risk remaining vulnerable to increasingly sophisticated supply chain attacks. Moreover, as regulatory expectations rise—particularly in sectors such as finance and critical infrastructure—organizations that lag in C-SCRM maturity may find themselves unable to meet compliance requirements or engage with key suppliers.

By following a structured, integrated, and resource-optimized approach to supplier cyberrisk assessment, organizations can not only improve their resilience but also foster stronger, more accountable relationships with their suppliers. The stakes are high, but so are the opportunities for those who act decisively.

Endnotes

¹ Li, F.; “Microsoft-CrowdStrike Outage: How a Single Software Update Was Able to Cause IT Chaos Across the Globe,” The Conversation, 2024
² Benaroch, M.; “Third-Party Induced Cyber Incidents—Much Ado About Nothing?,” Journal of Cybersecurity, vol. 7, iss. 1, 2021
³ National Institute of Standards and Technology (NIST), The NIST Cybersecurity Framework (CSF) 2.0, 2024, International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC), Joint Technical Committee on Information Technology (ISO/IEC JTC 1), ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection—Information security management systems—Requirements, Edition 3, 2022,  Regulation (EU) 2022/2554 of the European Parliament and of the council of 14 December 2022 on digital operational resilience for the financial sector and amending Regulations (EC) No 1060/2009, (EU) No 648/2012, (EU) No 600/2014, (EU) No 909/2014 and (EU) 2016/1011
⁴ ISO/IEC JTC 1, ISO/IEC 27005:2022 Information security, cybersecurity and privacy protection—Guidance on managing information security risks, NIST, NIST SP 800, Guide for Conducting Risk Assessments, USA, 2012
⁵ Federal Register, Executive Order 14028—Improving the Nation's Cybersecurity, USA, 12 May 2021
⁶ Deutsche Bundesbank, Banking Act (Kreditwesengesetz, KWG), Section 44—Information from and audits of institutions, ancillary banking services enterprises, financial holding companies and enterprises included in supervision on a consolidated basis, Germany, 1999
⁷ Regulation (EU) 2022/2554

SERGEJA SLAPNIČAR | PH.D.

Is an associate professor of accounting at the University of Queensland Business School (Brisbane, Australia). Her research focuses on internal audit, accountability, governance, and risk management in cybersecurity. Slapničar is a passionate educator and a recipient of various teaching awards, including the 2024 Australian Citation for Outstanding Contributions to Student Learning, as part of the Australian Awards for University Teaching. With more than 15 years of board experience as a non-executive director in various organizations, she has worked extensively with the Slovenian Directors Association, training more than 1,000 executive and non-executive directors in accounting, finance, and cyberrisk management. Slapničar is a member of ISACA^®, the Education Committee of the Institute of Internal Auditors (IIA), Australia, and the Auditing, Assurance, and Ethics Standards Committee at the European Accounting Association. She frequently presents her research at industry events.

TIM VIDMAR

Is a ServiceNow Consultant at Open Line Vitaly. Vidmar was awarded a scholarship by the American Slovenian Education Foundation that enabled him to conduct research on supplier cyberrisk assessment at the University of Queensland. Before joining Open Line Vitaly, Vidmar worked as an IT risk consultant at Deloitte, where he analyzed business processes and managed the design and implementation of general IT controls. His research interests focus on risk management in cloud computing and cybersecurity.