What this protects
Your vendors' access, and your liability for it
You remain responsible for client data even when a supplier loses it, and you are the one who has to make the phone call.
Your contractual exposure
Client contracts and data protection law hold you accountable for data a supplier mishandles on your behalf.
Client confidence
A breach that starts at a vendor is still your name on the letter that goes to the customer.
Tender and supplier lists
Larger clients increasingly audit your supply chain. Knowing your vendors is now part of winning the work.
The door you did not know you had left open
You can spend a fortune hardening your own systems and still hand the keys to someone who has not done the same. A supplier with access to your email, your finance system or your client files is part of your security whether you think of them that way or not.
The pattern is always similar. An attacker compromises a small, useful company, whether an accountancy firm, a software vendor or a managed service provider, then uses its trusted position to reach everyone it serves. You were not the target. You were the destination.
Why the quietest supplier is often the softest target
Your business is careful because it has something to lose and a reputation to protect. Some of your suppliers are two people and a shared inbox, with nobody whose job it is to think about security at all.
That is not a criticism of them. It is simply that a florist's invoicing tool and your payroll provider carry very different risk, and the smaller ones rarely get asked the awkward questions. Attackers do not care about your size; they care about your access.
The uncomfortable part is that this risk is invisible from your side. Nothing about an ordinary Tuesday tells you that a supplier's password was on a list being sold last week.
What to ask before you hand over access
Do you use multi-factor authentication?
If the answer is vague, that tells you as much as a no. It is the single most useful question you can ask.
How would you tell us if you were breached?
A supplier with no answer has never thought about it. Ask who would contact you, and how quickly.
Who actually has access to our data?
A specific person with a name and a reason, ideally, rather than \"the team\".
What happens to our data when we leave?
Where it is held, who can retrieve it, and when it is deleted. Get the answer before you need it.
Where does our data sit?
Which countries, and under whose control. Data that leaves the UK quietly is a compliance problem as well as a security one.
Who do we ring at 2am?
Not literally, but there should be a real route to a real person when something goes wrong.
The vendors most businesses forget to check
- Your IT provider, who holds the most access of anyone
- Accountants and payroll bureaux, who hold your financial detail and your staff records
- The software attached to your finance system, especially anything connected to your bank
- Your website developer, who may still have an administrative log-in nobody has used in a year
- Marketing and design agencies holding your customer lists
- Couriers, cleaners and anyone else with physical access to a room containing equipment
When a supplier cannot answer
Start with the questions that matter rather than insisting on everything at once. If a supplier cannot manage multi-factor authentication, that is a real risk. If their office cleaner has not read your security policy, that is a conversation, not a crisis.
Weigh it by what they can reach. A supplier with read-only access to a calendar is not the same as one that can move money or read client files. Prioritise the access, not the invoice.
The awkward part about your own suppliers
- Accept that you will not get a perfect answer from everyone, and decide your tolerance in advance
- Reduce access where you cannot get assurance, rather than simply hoping
- Keep a list of who has access to what, and review it when contracts renew
- Remember you are also someone else's supplier, and they may soon be asking you
What to do about it
- List every supplier with access to your data, then rank them by what they could reach.
- Ask about multi-factor authentication first; a vague answer is itself an answer.
- Cut access you cannot get assurance about, rather than carrying it indefinitely.
- Ask your own clients' questions before they ask you.
Questions we get asked about this
Does our supplier's breach become our problem?
Yes, in practice. You remain responsible for your clients' data even when someone else loses it, and you are the one who has to explain what happened.
Should we stop using small suppliers altogether?
No. A small supplier who thinks about security carefully can be safer than a large one that does not. The point is to ask, not to avoid.
How often should we review supplier access?
At least annually, and whenever a contract renews or a supplier changes hands. Access that is never reviewed quietly becomes access that is never questioned.