More and more cybersecurity entities (hereinafter – CSE) are entrusting the IT services and infrastructure necessary for their operational functions to third parties. While this simplifies organization operations, it also introduces new cybersecurity challenges. Vulnerability of CSEs through the supply chain and third parties—including subcontractors serving third-party providers—is identified by the European Union Agency for Cybersecurity (ENISA) as the most critical cybersecurity threat leading up to 2030.
Why is third-party management important?
As cybersecurity requirements become stricter, cybercriminals are increasingly targeting CSEs indirectly—through partners, suppliers, or subcontractors—where security standards are often lower and control measures weaker. Leveraging third-party services creates additional threats and factors beyond full control for CSEs, increasing vulnerability across the supply chain.
Key threats associated with outsourcing services to third parties:
- 1. Unaligned cybersecurity standards between CSE and third parties. Third parties or their subcontractors may not comply with the information security standards applied by the CSE, or may maintain lower cybersecurity standards than required by the criticality of the CSE's network and information system (hereinafter – NIS) assets.
- 2. Gaps in incident management and communication. Third parties may lack effective or appropriate incident management procedures, resulting in compromised prompt handling of cyber incidents and a failure to inform the CSE in a timely manner.
- 3. Deficiencies in or non-compliance with contractual obligations. Where contractual terms are ill-defined, third parties may fail to meet agreed service quality levels, neglect incident resolution, withhold information, or avoid applying required information security controls.
- 4. Untrustworthy subcontractors. Third parties may engage subcontractors listed on international sanction lists or operating in untrusted jurisdictions. This poses significant risks to the CSE's reputation, data, or contractual performance.
What measures should you implement to manage third parties effectively?
To protect CSE NIS assets and ensure robust cybersecurity, guidelines for third-party management must be established first. This requires drawing up a supply chain security management procedure that clearly defines third-party management principles, boundaries of responsibility, and the third-party lifecycle—from selection to contract termination. Beyond this framework, the following control measures should be implemented:
1. Identify and classify third parties
1.1. Register all third parties providing services to the CSE along with their subcontractors. Include the operational processes they execute and all provided NIS and information assets—such as software, IT systems, infrastructure, or networks.
2. Assess risks and technologies
2.1. To better determine a third party's inherent risk, evaluate—to the greatest extent possible—their technology, software, operational processes, and information security management policies.
2.2. Ensure that third parties essential to the CSE comply with the requirements of the Cybersecurity Law Requirements Description (hereinafter – CRLD) or relevant Information Security Standards (e.g., ISO/IEC 27001).
3. Clearly define contractual requirements
3.1. Incorporate CRLD requirements and information security standards directly into contracts. Read more in the CRLD tool.
3.2. Stipulate in contracts that third parties must provide information security audit reports upon request and allow the CSE—or a qualified third party hired by the CSE—to perform audits as needed.
4. Continuously monitor third parties
4.1. Apply the principle of least privilege to third-party personnel and services, ensuring access to NIS and organizational assets is minimal, time-bound, and strictly necessary for their specific job functions. Utilize Privileged Access Management (PAM), SIEM, or other security monitoring tools.
5. Manage incidents and business continuity risks
5.1. Ensure the third party has an action plan for high-impact incident and operational disruption scenarios to guarantee rapid service recovery, alternative solutions for critical operations, and business continuity.
5.2. Test incident response procedures—including backup restoration and business continuity plans—at least once every 12 months.
Plan for contract termination
The security level of the cybersecurity entity's NIS and other resources must be maintained throughout the entire termination process, regardless of whether services are being transferred to another vendor or brought in-house.
During contract termination, record all actions finalizing contractual obligations for both the third party and the purchasing organization, including lessons learned.
At the conclusion of service delivery, ensure that all CSE data is securely returned by the third party or destroyed with official proof of destruction provided. All third-party access to CSE NIS assets must be thoroughly reviewed and revoked during the termination process.
Summary
Third-party and supply chain management is a critical factor in effective cybersecurity. Achieving proper control requires establishing clear management guidelines, identifying risks, applying appropriate control measures, and maintaining continuous monitoring. Only comprehensive, consistent third-party management ensures long-term organizational resilience in an evolving threat landscape.
Have questions or want to learn more about securing your supply chain's cybersecurity? Let's connect.