Third-Party and Supply Chain Risk
What to know
Supply chain risk asks how you extend trust deliberately. Understand third-party lifecycle: due diligence, contracting with security requirements, onboarding, ongoing monitoring, and offboarding with data return or destruction. Know tiering by criticality and data access, and how that drives assessment depth. Understand the difference between inherent vendor risk and residual risk after contractual and technical controls.
Know assessment instruments by purpose: questionnaires, SOC 2 reports (and the difference between Type I point-in-time and Type II period), ISO 27001 certificates with scope statements, and penetration test summaries. Understand right-to-audit clauses, subprocessor and fourth-party visibility, breach notification terms, and data residency. Know software supply chain concepts: SBOM, dependency and artifact integrity, code signing, and build pipeline trust. Concentration risk and single points of failure belong here too.
Traps
- Accepting a certificate without checking its scope or date.
- Treating SOC 2 Type I as evidence of operating effectiveness over time.
- Ignoring fourth parties and subprocessors.
- Assuming contract clauses equal verified controls; monitoring is required.
Worked example / rule of thumb
A payroll vendor holds employee PII. Correct: tier as critical, require SOC 2 Type II with matching scope, add breach notification and audit rights, review annually, and confirm subprocessors. Rule of thumb: trust is granted by contract but maintained by evidence.