Learn / Small business security
Vendor and supply-chain risk for small businesses
Your suppliers, IT providers and software vendors can be the way attackers get in. Here is a proportionate way to check and limit that risk.
Why vendors matter
Small businesses rely on outsiders for almost everything: a managed IT provider with admin access, a web agency that holds the website password, cloud software that stores customer data, a payroll service, an accountant who receives tax files. Each one extends your attack surface. If an attacker compromises the vendor, they may reach you without ever touching your own systems.
This is not theoretical. The Target breach of 2013 began with credentials stolen from a heating and refrigeration contractor. The MOVEit attacks of 2023 reached many organizations through a file-transfer product used by them or by their service providers. Remote management tools used by IT providers have also been abused to push ransomware to many customers at once.
Step 1: list your vendors
Make a list of every outside organization that has one of the following:
- Access to your systems (remote support, admin accounts, VPN).
- A copy of your data or your customers' data.
- A role in moving money (payroll, payments, invoicing).
- Software running inside your business that updates automatically.
Rate each one high, medium or low based on what it could do if compromised. Your IT provider and your payments or payroll services are usually high.
Step 2: ask proportionate questions
You cannot audit a cloud giant, but you can ask sensible questions, and good vendors answer them readily:
| Question | Why it matters |
|---|---|
| Do you enforce MFA for your staff and for our admin accounts? | Stolen passwords are the most common entry point |
| How will you notify us of a security incident, and how fast? | You may have your own deadlines to meet |
| Do you have an independent security report (such as SOC 2 or ISO 27001)? | Shows controls are checked by a third party |
| Where is our data stored and how is it backed up? | Recovery and legal requirements |
| How do we get our data back if we leave? | Avoids lock-in during a crisis |
| Which of your staff can access our systems, and is it logged? | Limits insider and account misuse |
For low-risk vendors, a quick look at their security page is enough. For high-risk vendors, keep their answers on file.
Step 3: limit what vendors can reach
- Give each vendor its own named accounts, never a shared owner login, so access can be removed cleanly and actions are traceable.
- Least privilege: a web designer needs access to the website, not to email or banking.
- Time-limited access: turn remote support on when needed and off afterwards, where the tool allows it.
- MFA on vendor accounts you control.
- Review connected apps in Microsoft 365 or Google Workspace and remove those no longer used.
Step 4: put it in the contract
For high-risk vendors, the contract or terms should cover breach notification, data return and deletion when the relationship ends, and who pays for what after an incident. A lawyer can help with wording; many larger vendors have standard data processing agreements you simply need to sign.
Contract terms have legal consequences. Use this as a starting checklist, not legal advice.
Software supply chain basics
Software you install brings its own suppliers. Keep it updated, buy or download only from official sources, remove programs you no longer use, and subscribe to security notices from your critical vendors. When a major flaw makes the news, such as Log4Shell, ask your vendors directly whether they are affected and when a fix will arrive. Having a vendor list ready makes that a 20-minute job instead of a week of guessing.
Review yearly and when things change
Revisit the vendor list once a year and whenever you add a new provider, end a contract, or a vendor announces a breach. When a relationship ends, remove its access the same day, just as you would for a departing employee. See access control and offboarding.
