AI and cyber governance supply chain ‘gold standards’ to future-proof your business

Your digital supply chain could be one of the most significant sources of unseen AI and cyber exposure. As you may have increased the number of third-party IT vendors over the years, legacy access permissions may have gone unchecked and old contracts that worked when you first procured a service may not be fit-for-purpose now. Your cyber risks may have quietly multiplied.

Fragmentation between the teams procuring third-party IT vendors, those using them and finding their own cyber solutions independently of business oversight may all be contributing to a clouded view of their true cyber exposures.

Below, we look at how you can take back clarity and control.

By getting a fuller visibility of who holds your data and with more collaboration between otherwise siloed teams, you can move a step closer to ‘gold standards’ of digital supply chain governance.

What makes cyber supply chain risk management challenging?

Many factors contribute to the cyber supply chain challenge.  It could be that your procurement team is focused on the commercial priorities an IT solution promises and purchases it without fully understanding its data implications. Perhaps different business units or individuals are introducing IT or AI tools independently and therefore introducing unconsidered risks. Legacy suppliers may retain data they no longer need and without the guardrails you may assume are in place around data flows and storage.

We've also seen instances where contracts drafted years previous don’t include requirements for data privacy, AI oversight or mandatory reporting or they may be using outdated systems themselves that could offer cyber attackers a weak spot to exploit. It may be that subcontractors are accessing your data without your awareness. With one or a combination of these weaknesses and blind spots, your organization can be exposed to cyber incidents outside your direct control.

How can you create a complete view of your third-party IT supply chain?

Step 1: Create a detailed IT vendor inventory. This inventory should identify who has access to your data, why and how they use it and whether other parties are involved.

Step 2: Categorize vendors by risk level. You can then decide if you need to carry out a deeper review. For high-risk vendors, you may need to assess things like data flows, which is the movement and management of data as it travels between systems or applications and where your data is being stored.

Step 3: Evaluate your contracts to get more clarity on your third-party IT supply chain and its associated risks.

Step 4: Review your existing agreements to see whether they include specific security requirements, reporting obligations or data retention controls. If you uncover gaps, you can then plan to refresh contracts, strengthening your terms to strengthen your cyber resilience.

Step 5: Define clear approval pathways, which establish structured workflows to evaluate and authorize external technology suppliers before you integrate them into your organization, for onboarding new vendors will also help maintain cyber resilience.

How can procurement and cybersecurity work together to secure your IT supply chain?

In our experience, supply chain governance works best when procurement, cybersecurity and risk management functions collaborate closely.

Procurement brings visibility into upcoming contracts, commercial considerations and supplier capabilities. Cybersecurity adds expertise in assessing technical risks, asking the right questions and drafting controls.

Longer-term, you can also consider embedding cybersecurity specialists into procurement teams and establishing regular communication between your CISO and risk management specialists to maintain a more unified view of your cyber supply chain and keep on top of its risks.

Risk managers can bring a wider view of risks and support more effective and efficient decision-making on where the business should allocate resources for cyber resilience by using risk analytics.

Can analytical techniques strengthen your IT supply chain governance?

Analytical modeling provides insight on the impact of third-party cyber incidents. By looking at the scenarios most likely to impact your organization, you can estimate potential financial losses and operational disruption. This insight can help the risk manager to help the business prioritize investment in additional cybersecurity controls or cyberinsurance.

A deeper understanding of potential exposures allows your organization to establish evidence-based expectations for the level of cyber insurance your suppliers should carry.

What cyber certifications can help strengthen IT supply chain risk management?

Certifications can help establish whether your supplier meets baseline standards. For example, the Federal Risk and Authorization Management Program (FedRAMP) is a U.S. government-wide initiative providing a standardized approach to security assessment, authorization and continuous monitoring for cloud products and services, while the Cybersecurity Maturity Model Certification (CMMC) is a US Department of Defense framework that requires contractors to prove they protect sensitive information on their networks. However, certifications can’t replace detailed, supplier-specific assessments.

Achieving the highest standards of cybersecurity means doing the work around IT supplier inventories, understanding how each vendor manages data, how their subcontractors operate and whether their practices match your cyber governance expectations.

To learn more about strengthening AI and cyber governance across your digital supply chain and understanding potential areas of exposure, speak to our cyber risk specialists.