CyberScotland Partnership is encouraging businesses and organisations across Scotland to take practical steps to secure their supply chains to stay ahead of evolving cyber threats.

This fourth organisation and business asset pack focuses on supply chain security. We are focusing on five steps that can make a real difference to protecting your organisation.

Criminals don’t always target organisations directly. They target the way in, and your suppliers, software providers and third-party partners can all represent entry points if their cyber security isn’t up to scratch.

Whether you’re a small business, large firm, charity or a public sector organisation, securing your supply chain doesn’t require specialist technical knowledge.

Consistent, simple steps can make a significant difference. We encourage you to share this article and asset pack and revisit it throughout the year.

Together, we can help organisations across Scotland get ahead on cyber resilience, protect their data and stay secure.

Five critical steps to secure your supply chain

Know your suppliers

Map every supplier with access to your systems or data. If you can’t name them, you can’t protect yourself. Suppliers change, contracts evolve, and new online tools and platforms get added over time. The number of third parties with access to your data can grow without you realising it. Regular mapping of your suppliers keeps you in control.

Set minimum standards

As well as knowing your suppliers, be sure that they meet a minimum security standard and make this a part of your procurement process. Time pressures and complex procurement processes can mean cyber security requirements get overlooked when contracts are being drawn up. But without a minimum standard written in and agreed upfront, your organisation is exposed if a supplier’s security falls short. If it’s not in the contract, you have no way to enforce it and no comeback if something goes wrong.

Cyber risk doesn’t stay with your supplier. It comes straight back to you.

Set a baseline. Write it in. Make it non-negotiable.

Ask about Cyber Essentials

Cyber Essentials is the UK government-backed standard that protects against the most common cyber attacks. Ask your suppliers whether they hold Cyber Essentials certification or an equivalent standard as a minimum. If they can’t confirm that they do, that’s a risk your organisation is also carrying. Build Cyber Essentials into your procurement as a condition, not a conversation.

You can find it at:

Cyber Essentials | National Cyber Security Centre

For smaller organisations and charities where achieving full Cyber Essentials certification may not be feasible right now due to in-house resource and expertise limitations, the NCSC’s free Cyber Action Toolkit is a practical starting point and can also be factored into both your own organisation’s requirements and as an alternative procurement requirement for smaller organisations such as charities or other third sector and supported businesses. It walks you through the actions that matter most, without needing technical expertise.

You can find it at

Cyber Action Toolkit – Cyber Scotland

Review and monitor regularly

A supplier that met your standards when you signed the contract may not meet them today. Cyber threats evolve, and so do the risks suppliers bring. Building regular security reviews into your supply chain processes and regularly asking the right questions will help you spot gaps early and respond to changes before they become vulnerabilities.

It also demonstrates to your own stakeholders that your organisation takes supply chain risk seriously.

The cyber threat doesn’t stop. Neither should you.

Scottish public sector: Build cyber assurance into procurement from the start

If you’re procuring on behalf of the Scottish public sector, cyber security should be built in from day one. Supply25 is a platform that brings buyers, suppliers and assessments together making it straightforward to set minimum cyber security standards and reduce supply chain risk.

It helps public sector buyers create and adopt high quality assessments so that the supply chain is secure, resilient and robust.

The Scottish Government has funded dozens of licenses across public sector organisations, making it a critical tool for doing business with local and national government

Don’t leave it to chance. Set the standard before you sign any contracts.

Find out more at www.supply25.com.

Cyber resilience is built and strengthened through following a consistent process and delivering consistent actions across your organisation. By securing your supply chain and sharing guidance with your teams, you can reduce risk to your organisation and stay ahead.

Know your supply chain. Manage your risk.

Additional Resources / For Further Reading:

The following websites include additional advice and links to other trusted resources where you can find out more:

CyberScotland Partnership

Supply Chain – https://www.cyberscotland.com/advice-and-guidance/supply-chain/

Cyber Action Toolkit https://www.cyberscotland.com/ncsc/ncsc-cyber-toolkit/

Police Scotland – Cybercrime

Cyber Alarm – https://www.cyberalarm.police.uk/

National Cyber Security Centre (NCSC) – Supply Chain Security Guidance

Supply Chain Security Guidance https://www.ncsc.gov.uk/collection/supply-chain-security

Cyber Essentials Supply Chain Playbook https://www.ncsc.gov.uk/information/cyber-essentials-supply-chain-playbook

Cyber Essentials https://www.ncsc.gov.uk/cyberessentials/overview

Governance for Boards Toolkit https://www.ncsc.gov.uk/cyber-governance-for-boards/toolkit

Cyber Governance Code of Practice https://www.ncsc.gov.uk/cyber-governance-for-boards/code-of-practice

UK Cyber Security Council – Risks in cyber supply chain

https://www.ukcybersecuritycouncil.org.uk/blogs/the-risks-in-the-cyber-supply-chain

IASME

https://iasme.co.uk/articles/cyber-essentials-in-the-supply-chain-a-digital-brochure/

Supply25 – Public sector procurement

https://supply25.com

SCVO – third sector support

https://scvo.scot/support/digital/cyber-resilience

SC3 Daily Threat Reports