The importance of third-party supply chain cybersecurity has become increasingly apparent over the past few years. The recent well-publicized incident at SolarWinds, an IT service provider, is the latest example of a supply chain attack, where the intended victim is not the organization itself, but rather its customers and business partners. Over the past year, the cyber "attack surface" and the amount of sensitive data to which third-party vendors have access has increased due to the large uptick in remote working because of the COVID-19 pandemic. In response to a recent survey by the Ponemon Institute of 581 IT security professionals and 302 C-suite executives, 58% of respondents said that, despite the increased risk, their organizations do not have a third-party cyber risk management program. Ponemon Institute, Digital Transformation & Cyber Risk: What You Need To Know To Stay Safe (2020).

Attacks on third-party vendors have risen in number and severity. 2020 saw a 430% increase in attacks on third-party supply chains. Cyber Attacks: Better Vendor Risk Management Practices in 2021, Shared Assessments (Dec. 18, 2020). Ransomware attacks in particular have seen the most growth, increasing by 715%. BitDefender, Mid-Year Threat Landscape Report 2020 (2020).

Cyberattacks on an organization's third-party vendors present a unique set of challenges. Not only are they harder to detect, but they are also harder to respond to and recover from. Because organizations have far less visibility into a cyberattack on a vendor than they would if they experienced an attack themselves, everything from containment to legal compliance is more difficult. In addition, while many organizations focus their third-party oversight efforts on vendors that hold their personal identifiable information (PII), some do not sufficiently consider the implications of a cybersecurity incident at a vendor that does not hold PII but is nonetheless integral to the organization's supply chain. As outlined below, organizations can take a number of steps to proactively respond to the inevitable attack on their third-party vendors.