Assessing your suppliers¶
The risk you do not control¶
The scenario analysis identified several other organisations in Scaldimet's attack paths: the SCADA and MES vendors providing remote support and software updates to production systems, the cloud ERP provider holding business and personal data, and the maintenance contractor with trusted access to the OT. Two different types of weakness are involved here, and separating them matters.
-
Where the weakness is in a supplier's own security, such as how it secures the data you share with it, whether its software updates are trustworthy, or how it vets its staff and subcontractors, you cannot directly remediate it. You can gain assurance over it, address it through contractual requirements, and monitor it. That is third-party risk management (TPRM), and NIS2 identifies supply-chain security as a required measure (Article 21, Lesson 3.4.A).
-
Where the weakness is instead in your own controls over a third party's access, for example, the contractor's sessions into the OT are unsegmented and unmonitored, that is not a third-party security weakness. It is your access-control gap, which must be addressed through your own controls, such as the segmentation and monitored conduit discussed in Chapter 4.6.
The contractor sits in both contexts: it is a third party whose security you must assess and whose obligations you must address contractually, but it also reaches your systems through an access path that you must control. Keep the two separate: a contractual requirement cannot replace a control that Scaldimet must operate itself, and an internal control cannot remediate a weakness in the supplier's own security.
Inventory and tier¶
You cannot assess suppliers you have not listed, and you cannot assess all of them equally. So TPRM starts with two steps. Inventory: list the third parties that touch your business values, which the ecosystem mapping of Chapter 4.4 already began. Tier by criticality: rank them by how much harm their compromise could do to you, not by how much you spend with them. A cheap maintenance contractor with deep, trusted OT access is a far higher tier than an expensive supplier of office stationery. Tiering is itself a risk judgement, and it directs the rest of the effort.
For Scaldimet, the scenarios place the maintenance contractor and OT vendors in the highest tier, because they have privileged access to the production line, the highest business value. The corporate-IT and commodity suppliers sit lower.
Assess proportionately¶
Assessment scales with tier. For low-tier suppliers, a short self-assessment questionnaire or evidence of a recognised certification may be enough. For high-tier suppliers, you want more: evidence of an ISO 27001 certificate or equivalent (note the symmetry, this is what Scaldimet's own customer demands of it), answers to a security questionnaire, and for the most critical, the right to audit or to see independent assurance. The objective is proportionate to the harm the supplier could cause.
Contract and monitor¶
Two elements turn a supplier assessment into actual risk reduction. Contractual security obligations define what the supplier must do or permit: maintain its own security, notify you of relevant incidents, notify you of personnel changes affecting its access, permit monitoring and audit, and secure its sub-contractors. These requirements give you enforceable obligations and rights if something goes wrong. The division of responsibility is important: the contract can require the contractor to comply with and support least-privilege, logged and monitored access; building that segmentation and monitoring is your own applied control (Chapter 4.6), not something a contractual clause can deliver.
The second element is ongoing monitoring. A point-in-time assessment becomes outdated quickly (the checkbox trap of Lesson 3.7 applies to suppliers too), so high-tier suppliers need periodic reassessment and, where feasible, continuous or event-driven monitoring signals.
For Scaldimet, the clearest TPRM deficiencies are that these suppliers have no incident-notification obligations, no audit rights for Scaldimet, and no assurance requirements covering their own security. The contractor's unmonitored sessions, by contrast, are an access-control gap that Scaldimet must address through its own controls (Chapter 4.6), not a TPRM issue.
Application: tier and treat Scaldimet's suppliers¶
On paper, list Scaldimet's main third parties, assign each a criticality tier based on the harm its compromise could do, and for the top tier write the assessment depth you would require and two contractual security obligations you would insist on.
Model answer (open after you've drafted yours)
Tiering (by the harm a compromise could do):
-
Critical: the maintenance contractor (trusted remote access to Beta's OT); the SCADA/MES vendors (privileged access to production systems).
-
Important: the cloud ERP provider (business and some personal data); the IT managed-service provider.
-
Standard: commodity suppliers with no access to systems or data.
Critical tier — assessment depth: more than a questionnaire. Evidence of a recognised certification or a right-to-audit, their own incident-notification commitment, named security contacts; re-assessed annually and on any major change.
Two contractual security obligations: (1) the supplier maintains defined security controls over its own systems and the access it holds, permits Scaldimet's monitoring and audit, and notifies Scaldimet of any personnel change affecting that access; (2) the supplier notifies Scaldimet of a relevant security incident within a fixed short window and supports the investigation. The contract makes the contractor accept and support limited, logged, monitored access — but building that segmentation and monitoring is Scaldimet's own applied control (Chapter 4.6). The highest-value fix has two halves: the access control you build, and the assurance and duties you contract.
Key takeaway
Third-party risk is exposure through organisations you do not control, and NIS2 requires you to manage it. TPRM starts by inventorying the third parties that touch your business values and tiering them by the harm their compromise could cause (not by spend), then assessing them proportionately to tier, from light questionnaires to certification evidence and audit rights for the most critical. Assessment becomes real risk reduction only through contractual obligations (access limits, incident notification, audit rights) and ongoing monitoring, because a point-in-time assessment also becomes outdated as the supplier, its access or the threat environment changes. For Scaldimet, the maintenance contractor and OT vendors are top tier; the clearest third-party gap is the absence of assurance and contractual duties over them (incident notification, audit rights, evidence of their own security), while the contractor's unmonitored access is an access-control gap fixed by Scaldimet's own controls (Chapter 4.6).
Next: Lesson 4.8.B · Being assessed as a critical supplier →