What We Do
How We Do
Get Started

Policies, Prevention, and Promises: How to Protect Your Organization from Third-Party and Supply Chain Risks

BY eSentire

May 2, 2022 | 5 MINS READ

Third-Party Cyber Risk

Want to learn more on how to achieve Cyber Resilience?


Partnering with external suppliers and vendors is necessary for almost every business and can provide competitive advantages, but third-party and supply chain vendors can also increase your cyber risk. By outsourcing some of your business functions to one or more third-party vendors, your data becomes a part of a web that leaves more entry points and weaknesses for threat actors to exploit. Regardless of how well planned your layered cybersecurity defenses are, it’s important to remember that your vendors may not be as vigilant about their own approach to cybersecurity.

It's no surprise that cyber threat actors are taking advantage of the external vendors’ lack of cybersecurity maturity and targeting their customers. In a 2018 supply chain cyberattack discovered by eSentire against Kaseya, an IT Management Software company, an unknown threat actor tried to leverage a zero-day vulnerability in Kaseya’s Virtual System Administrator (VSA) agent to gain access to our customers’ network. The goal of this was to deploy the Monero cryptocurrency mining malware to multiple eSentire customers.

Kaseya also faced a supply chain cyberattack after it was discovered that their VSA platform was being used by cybercriminals to deliver ransomware through an auto-update. This breach impacted 60 customers and close to 1,500 downstream businesses.

The reality is that third-party vendors with access to your data may not meet the same standards of cybersecurity procedures and policies that your organization has implemented. So, it is up to you to ensure that you are conducting the due diligence needed to protect your company from third-party vendor risk.

The Three Ps of Third-Party and Supply Chain Risk: Policies, Prevention, and Promises

In order to effectively address third- party risk, you need to pinpoint any vulnerabilities and weaknesses present in your vendor’s systems or processes. One way to approach this is to consider the three Ps of third-party and supply chain risk: policies, prevention, and promises:

Policies: Minimize your cyber risk

While many third-party partners rely on your data to deliver their services, you should understand what information they need, and what information you are willing to share prior to establishing partnership. It is also important to consider who can access this information and the process of granting them this access.

The end goal here is to minimize the number of third-party and supply chain risks by proactively defining supply chain policies, developing the necessary due diligence tools, setting validation meetings on a consistent basis, raising the overall security awareness around the policies being set at your organization, and encouraging your team and suppliers to improve.

Prevention: Measure your cyber risk

The core objective here is ensure that you understand if there are any threats and risks that may arise once you’ve set up your policies. From here, you can work with your third-party vendors to set expectations and requirements with their cybersecurity processes that mitigate your organization’s cyber risks.

Therefore, the most critical steps you can take from a prevention standpoint are to start by identifying your assets and obligations, defining your organization’s tolerance for risk, conducting a vendor risk assessment (or at minimum, a due diligence questionnaire) and defining the defensive requirements to address them.

Promises: Mitigate your cyber risk

Once you’ve set up your policies and preventative measures, the last thing to consider is how you’ll mitigate third-party risk by establishing and following contractual obligations, documents, and standards in the event of a cyberattack. Therefore, any contract you sign with your third-party vendor should extend from simple things like service definitions and pricing to the minimum cybersecurity requirements.

Here you should consider what to do when your vendor faces a cybersecurity incident, ranging anywhere from detecting unauthorized activity to a successful data breach. Both parties should agree on what activity is worth flagging, who works to resolve it, and what information should be logged for forensic analysis. Another important factor to consider – who is responsible if damages occur?

Any business or organization, regardless of their size, is a potential target for a cyberattack. However, trusted vendors who serve a larger client base are especially at risk as threat actors may have access to a downstream client base in the event their attack is successful.

How can organizations protect themselves from third-party risks?

The key to mitigating third-party risk lies in taking proactive measures prior to finalizing business partnerships. Ask yourself, how susceptible are your third-party partners to phishing attempts? What potential zero-day vulnerabilities could be present that would allow threat actors to access your data?

Our Due Diligence Questionnaire can help your team highlight which third-party and supply chain risks your organization may be susceptible to.

However, while a due diligence questionnaire is a good starting point for this discussion, what your team will really benefit from is conducting a thorough Vendor Risk Assessment.

The assessment will help you answer questions regarding your third-party and supply chain risk such as:

Given the explosive growth of supply chain cyberattacks globally, a vendor risk assessment will give you the peace of mind you need since it provides:

Based on data findings and security program recommendations that a vendor risk assessment provides, you can plan your cybersecurity defenses around your vulnerabilities to ensure you have the tools, technology, and people you needed to successfully mitigate your third-party risks.

When creating a cybersecurity plan that addresses your third-party risks and vulnerabilities, it is important to review “the 3 Ps” of third-party and supply chain risk to maximize your cybersecurity defenses and leave no loose ends for potential zero-day attacks.

Good things come with time. By going through a vendor risk assessment with your partners, both parties will come out with stronger defense measures, a clearer understanding of their cyber risks, and a detailed response plan that gives peace of mind.

Ready to mitigate your third-party risk with a Vendor Risk Assessment? Book a meeting with an eSentire cybersecurity specialist to get started.


eSentire, Inc., the Authority in Managed Detection and Response (MDR), protects the critical data and applications of 2000+ organizations in 80+ countries, across 35 industries from known and unknown cyber threats by providing Exposure Management, Managed Detection and Response and Incident Response services designed to build an organization’s cyber resilience & prevent business disruption. Founded in 2001, eSentire protects the world’s most targeted organizations with 65% of its global base recognized as critical infrastructure, vital to economic health and stability. By combining open XDR platform technology, 24/7 threat hunting, and proven security operations leadership, eSentire's award-winning MDR services and team of experts help organizations anticipate, withstand and recover from cyberattacks. For more information, visit: www.esentire.com and follow @eSentire.

Read the Latest from eSentire