Manage Your Supply Chain Risks

A disruption in your supply chain or a service provider security breach can have a material impact on your operation and damage your organization's image and reputation. Ensure preventive, detective, and corrective controls are in place to manage your supply chain risks.

The first step is to perform a supply chain risk assessment.  Identify your assets and related threats and vulnerabilities. Once your assets, threats, and vulnerabilities have been identified, determine the impact of each vulnerability or event on your organization. Once your know your risk areas, identify controls that reduce, eliminate, or transfer the risks.

The supply chain risk assessment should have defined goals and objectives. Aligning these goals and objectives with your organization’s business drivers allows your organization to prioritize and focus on critical systems and assets including your supply chain and third party service providers.

When evaluating supply chain risks, consider the criticality and importance of the outside entity and determine which supply chain IT infrastructure components and assets are most important to your organization. In some cases, you may want to limit the scope to mission-critical components and assets only. Examples of supply chain risks include:

• Inadequate needs assessment and planning
• Insufficient capacity planning
• Contingency risks caused by not having backup or alternative solutions
• Ineffective security controls

At a minimum, the risk assessment should:

• Be performed on an annual basis or more frequently if major changes occur to the environment or services performed
• Identify compliance objectives and control requirements
• Identify risks related to business continuity, capacities, and dependent services

Summary

When evaluating supply chain services, consider not only functionality but also security and availability of systems and services. IT risk assessments and network security audits evaluate information security, service level performance, support (technical and user), redundancy and availability, as well as fail over and contingency plans.