What is third-party cyber risk, and how should we manage it?

Third-party cyber risk is the chance that a supplier, partner or service provider causes you a security incident or outage, through access to your systems, data they hold for you, or software and services you depend on. You manage it by knowing which suppliers matter most, setting proportionate security requirements, writing them into contracts and checking them over time.

Almost every organisation now relies on outside providers for email, cloud hosting, payroll, IT support, software and payments. Each one extends your attack surface beyond the systems you control. Yet supplier risk is still one of the least managed areas of cyber security in the UK. This guide explains where the risk comes from, how to manage it in proportion to what is at stake, and what regulators expect.

Where third-party cyber risk comes from

The UK Cyber Security Breaches Survey 2025/2026 lists the main ways suppliers create risk: third-party access to an organisation’s systems, suppliers storing personal data or intellectual property, and phishing or malware originating from suppliers (DSIT and Home Office, Cyber Security Breaches Survey 2025/2026, retrieved 20 October 2026). In practice the risk falls into four groups:

• Access. IT providers, developers and support companies often hold administrative access to your systems. If their accounts are compromised, so are yours.
• Data. Cloud platforms, payroll bureaux, CRM providers and marketing agencies store information on your behalf. A breach at their end is still your customers’ data.
• Software and updates. Products you install, and the updates they push, run inside your environment with your trust.
• Dependency. If a critical supplier suffers an outage or ransomware attack, your operations can stop even though your own systems are untouched.

There is also fourth-party risk: your suppliers’ own suppliers. You rarely have a contract with them, but you inherit their weaknesses.

How UK businesses manage supplier risk today

Formal supplier review remains rare. Just 15% of UK businesses said they reviewed the cyber security risks posed by their immediate suppliers, and 6% looked at their wider supply chain. The figure rises with size: 30% of medium businesses and 48% of large businesses review immediate suppliers, but only 24% of large businesses look at the wider chain (DSIT and Home Office, Cyber Security Breaches Survey 2025/2026, retrieved 20 October 2026).

Large businesses are becoming more demanding of their suppliers. In the same survey, 41% of large businesses required suppliers to hold a security standard or accreditation, up from 21% the previous year, and 26% required Cyber Essentials specifically, up from 10%. If you sell to larger organisations, expect more of these questions.

How to manage third-party risk proportionately

The NCSC’s supply chain guidance sets out 12 principles in four stages: understand the risks, establish control, check your arrangements, and continuous improvement (NCSC, Supply chain security guidance, retrieved 20 October 2026). In practice, a proportionate programme has five parts.

1. Know your suppliers and tier them

Start with a list of suppliers that hold your data, connect to your systems or support critical services. Then rank them. The NCSC suggests considering questions such as whether the supplier will access sensitive data, connect to your network with privileges, or be a single point of failure (NCSC, How to assess and gain confidence in your supply chain cyber security, retrieved 20 October 2026). A handful of suppliers will usually account for most of your exposure.

2. Set minimum requirements by tier

Decide what you expect from each tier. Low-risk suppliers might only need to confirm basic controls. Critical suppliers might need to hold a recognised certification, provide independent test results, and meet specific requirements such as multi-factor authentication on accounts that access your systems.

3. Build requirements into contracts

A requirement that is not in the contract is a request. For critical suppliers, contracts should cover security obligations, prompt notification of incidents, your right to audit or receive assurance evidence, controls on subcontracting, and how data and access are returned or removed at the end. Where suppliers process personal data, UK GDPR already requires a written contract with specific terms, and the ICO is clear that controllers remain primarily responsible for overall compliance (ICO, Contracts, retrieved 20 October 2026).

4. Gain assurance before and during the relationship

Questionnaires, certificates and test reports all have a place, but none is enough alone. Check that a certificate’s scope covers the service you are buying, and that it is current. For your most critical suppliers, ask for evidence rather than answers, and repeat the check periodically rather than only at onboarding. Our assurance service includes reviews of your own suppliers.

5. Plan for failure and exit

Assume a key supplier will one day have an incident or outage. Know what you would do, how you would be told, and how you would switch provider or bring the service in-house if you had to.

Supplier risks belong in the same register as your other cyber risks, scored and owned on the same terms. Our risk management work covers listing, tiering and treating third-party risk alongside everything else.

What regulators expect

For boards generally, the UK government’s Cyber Governance Code of Practice asks directors to gain assurance that supplier information is routinely assessed in proportion to risk, and that the organisation is resilient to cyber risks from its supply chain and business partners (DSIT, Cyber Governance Code of Practice, retrieved 20 October 2026).

In financial services, the obligations are more specific:

• DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025. It requires in-scope financial entities to manage ICT third-party risk as part of their ICT risk framework, keep a register of information covering all ICT service contracts (Article 28), and include key contractual provisions in those contracts, with extra requirements, including exit strategies, for services supporting critical or important functions (Article 30) (EUR-Lex, retrieved 20 October 2026). UK firms that supply EU financial entities feel this through their contracts.
• NIS2 (Directive (EU) 2022/2555) lists “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” among the measures in-scope entities must take (Article 21(2)(d)) (EUR-Lex, retrieved 20 October 2026).

Our guide to NIS2, NIST, CIS and DORA for financial services explains how these frameworks fit together and why supplier risk is where they overlap most.

In-house or outsourced?

Ownership of supplier risk should sit inside the business, because only you can decide which suppliers are critical and what risk you will accept. The legwork is a different matter. Building the supplier inventory, designing tiering and questionnaires, reviewing evidence and assessing critical suppliers takes specialist time, and many organisations bring in outside help to set the programme up, then run the routine parts themselves.

Common mistakes

• Sending every supplier the same long questionnaire. Low-risk suppliers ignore it and critical suppliers are not examined closely enough.
• Accepting a certificate without reading its scope. A certification may cover a different part of the supplier’s business from the service you use.
• Reviewing suppliers only at onboarding. Suppliers change, get acquired and change their own providers.
• Leaving it to procurement alone. Procurement can run the process, but security and business owners need to judge the risk.
• Forgetting exit. Without a plan to recover data and remove access, ending a contract can create its own risk.

Frequently asked questions

Is a supplier’s ISO 27001 certificate or Cyber Essentials enough?

They are useful evidence, but they answer narrower questions than people assume. Cyber Essentials covers a set of baseline technical controls, and an ISO 27001 certificate only applies to the scope written on it. For critical suppliers, check the scope and date, and ask how the controls apply to the specific service you are buying.

How far down the supply chain should we look?

Focus first on your direct suppliers, since that is where you have contracts and leverage. For critical services, ask those suppliers how they manage their own key providers and require them to pass on equivalent security obligations. Trying to assess every fourth party directly is rarely practical.

What should we do if a critical supplier will not answer our security questions?

Treat the refusal as information. Explain why you are asking, offer to accept existing evidence such as certifications or independent reports, and escalate commercially if needed. If you still cannot get assurance, record the risk, agree who accepts it, and consider whether an alternative supplier is viable.

Are we responsible if a supplier loses our customers’ personal data?

If you are the controller and the supplier processes data on your behalf, you remain responsible for choosing a processor that provides sufficient guarantees and for putting the required contract in place (ICO, retrieved 20 October 2026). The supplier has its own obligations too, but the incident will still affect your customers and your reputation.

Getting started

Begin with a list of the suppliers you could not operate without, and ask what would happen if each one were breached or went offline tomorrow. That list is the core of your third-party risk programme. Our risk management service can help you tier suppliers, set requirements and bring supplier risks into your wider register.

To discuss your supply chain, talk to our team.