Vendor Security: How to Vet Your Suppliers' Cyber Practices

Your business is only as secure as the weakest supplier with access to your data or systems. A cloud accounting platform, an outsourced IT provider, a marketing agency with your customer list — each is a door into your business, and a breach at their end is your problem too. Vetting your suppliers' cyber practices is simply extending your own security perimeter to the people you rely on.

Why supplier security is your problem

Under Australian privacy law, if a supplier you engaged mishandles personal information you're responsible for, the accountability doesn't neatly stop at their door — and neither does the reputational damage. Attackers know this too. Supply-chain attacks target a single provider precisely because it opens a path into many of their customers at once. For a small business, the risk usually isn't a sophisticated nation-state attack; it's a provider with weak password practices, no backups, or an admin who clicked the wrong link. The good news is that the same basics that protect you — the kind of controls in the ASD Essential Eight — are exactly what you should expect from anyone you trust with access.

Tier your suppliers by risk first

You can't scrutinise every vendor equally, and you shouldn't try. Sort them by how much damage they could cause:

• Critical — anyone holding your customer or employee data, your financials, or with administrative access to your systems (accounting software, CRM, payroll, outsourced IT, cloud hosting). These get the most scrutiny.
• Moderate — suppliers with some access or integration but limited sensitive data.
• Low — vendors with no access to your systems or data at all. A basic sanity check is enough.

This tiering keeps the effort proportionate and focuses your attention where a failure would actually hurt.

What to actually ask a supplier

You don't need to be a security expert to ask good questions. For your critical suppliers, work through:

• Access and authentication. Do they enforce multi-factor authentication for staff and admin accounts? How do they control who can reach your data internally?
• Data handling. Where is your data stored, is it encrypted in transit and at rest, and who can access it? Is it held onshore or overseas, and does that matter for your obligations?
• Patching and maintenance. Do they keep their systems and applications up to date? Unpatched software is one of the most common entry points.
• Backups and recovery. Do they back up regularly, and have they tested that they can actually restore? Backups nobody has tested are a false comfort.
• Incident response. If they're breached, how and how quickly will they tell you? A notification obligation belongs in the contract.
• Certifications. Do they hold a recognised standard such as ISO 27001, or align to the Essential Eight? Certification isn't a guarantee, but it signals they've been assessed against a framework.
• Their own supply chain. Who do they subcontract to, and does your data flow further down the chain?

For a small supplier, a short questionnaire or even a frank conversation is often enough. For a critical one, get the important answers in writing.

Put protections in the contract

Trust is good; a written obligation is better. In agreements with your higher-risk suppliers, look to include the right to be notified promptly of a security incident, clear commitments on how your data is protected and where it lives, restrictions on onward sharing and subcontracting, and a defined process for returning or destroying your data when the relationship ends. These clauses cost nothing to add up front and are invaluable if something goes wrong.

Make it ongoing, not one-off

Vetting a supplier once, at onboarding, and never again is how gaps creep back in — providers change hands, drop standards, or quietly expand what they can access. Keep a simple register of who has access to what, review your critical suppliers periodically, and reassess whenever a provider changes ownership or you grant them new access. Tightening the access you grant in the first place — least privilege, removing dormant accounts, revoking access the moment a relationship ends — does as much for your security as any questionnaire.

Supplier security sits alongside your own controls as part of a resilient operations back office. You'll never eliminate third-party risk entirely, but knowing which suppliers could hurt you, asking them the right questions, and holding them to it in writing turns an invisible exposure into a managed one.