Manage third-party cyber risk

The invoice may change hands. The accountability doesn’t.

Outsourcing can help businesses scale, access specialist expertise and operate more flexibly. Building cyber resilience into those relationships helps make them stronger.

Few organisations want, or need, to build and operate everything themselves. Customer service may be delivered by a specialist partner. Finance might run on a cloud enterprise resource planning (ERP) platform. Payroll, HR, email and collaboration may be online services. A managed IT provider may look after infrastructure, while another partner monitors security. Global talent partners can help build teams in new markets.

Each decision can reduce cost, add expertise and free internal resources to focus where they add most value. But as suppliers become part of day-to-day operations, clear responsibilities, sensible access and security expectations become part of good outsourcing practice.

You can outsource a service and delegate responsibility for operating parts of it. You may transfer some financial risk through contracts and insurance. Your organisation still needs to own the decisions about its cyber risk, oversee the relationship and retain the capability to respond. Suppliers also remain accountable for their own obligations.

Your customer won’t care whose system failed

Imagine your customer portal suddenly goes offline. Your provider has suffered a cyber incident. Systems are unavailable, customer information may have been accessed and nobody can yet tell you when normal service will return.

Technically, the incident happened to your supplier. But consider what happens next:

Whose customers cannot access the service?
Whose employees cannot work effectively?
Whose leadership team has to explain the disruption?
Whose reputation is affected?
Who must make the business decisions?

The consequences reach your organisation. That makes third-party cyber risk a business issue requiring leadership ownership, procurement involvement and operational support.

Know what the supplier is responsible for, what the client remains responsible for and how both will review those responsibilities. Each important relationship needs a named owner inside your organisation, with a clear route for escalating concerns and accepting residual risk.

Outsourcing does not equal risk removal: business, supplier, further dependencies and returning business impact

Why supplier assurance matters now

Verizon’s 2026 Data Breach Investigations Report found third-party involvement in 48% of the breaches in its dataset. That is a finding about the breaches analysed, rather than a prediction that 48% of all suppliers will suffer a breach. [1]

The UK Government’s Cyber Security Breaches Survey 2025/2026 found that 43% of businesses identified a breach or attack in the previous 12 months, rising to 65% of medium businesses and 69% of large businesses. Yet only 15% of businesses formally reviewed cyber risks from immediate suppliers, and 6% looked at their wider supply chain. [2]

These findings support a practical point: the more a business relies on external providers, the more useful it becomes to understand how those providers contribute to its resilience. The NCSC’s supply-chain guidance recommends understanding risks, establishing controls, checking arrangements and improving them over time. [3]

Risk transfer is not risk removal

Contracts matter. They can define:

Security requirements, service levels and responsibilities.
Incident reporting triggers, notification timescales and escalation contacts.
Data protection, handling, storage and access requirements.
Audit rights, evidence requirements and liability.
Business continuity, recovery expectations and exit arrangements.

Cyber insurance may transfer some financial consequences, subject to its terms. Neither a contract nor an insurance policy removes the underlying business dependency.

A contractual penalty will not necessarily get customers back online. An indemnity will not immediately restore lost information. Insurance will not run payroll on Friday morning. A supplier accepting liability will not automatically repair your reputation.

The useful question is:

Do we understand the risk created by outsourcing this service, and are we comfortable with how that risk is being managed?

The three layers of third-party risk: transfer, control and accountability

Identify your critical suppliers and dependencies

Not every supplier needs the same scrutiny. A furniture supplier with no access to systems or sensitive information presents a different exposure from the organisation hosting your customer database or administering your ERP platform.

Focus on business dependency. A supplier merits particular attention when it can:

Access personal, sensitive or commercially important information.
Connect to your systems or hold administrator accounts.
Operate a critical business process or communicate with your customers.
Store information you rely on.
Prevent you operating if its service becomes unavailable.
Affect your regulatory or contractual obligations.

This includes payroll providers, outsourced customer service, ERP partners, accountants, developers, HR platforms, managed IT companies, marketing agencies and cloud providers.

Then consider their suppliers. Your provider may rely on cloud platforms, software vendors, data centres, subcontractors or specialist support companies. One relationship can become a chain of dependencies you did not directly choose. Understand which dependencies support the service, what information they handle and what happens if they fail.

A supply chain extends beyond your direct supplier, and disruption can reach your customers

Five questions every business leader can ask

You do not need to become a cyber expert to ask useful questions. Start with these five.

1. IMPACT — What happens if this supplier stops working tomorrow?

Would customers be affected?
Could employees continue working?
Could you still invoice customers, pay employees and access critical information?
How long could you realistically operate without the service?
Who inside your organisation owns this dependency?

The purpose is to understand business impact and decide where assurance has the greatest value.

2. ACCESS — What can they reach?

Understand access to customer and employee information, business systems, email, cloud platforms, administrative accounts, networks and financial information.

Good access management makes outsourced operations easier to manage. Ask:

Who approves access, and is every account linked to an identifiable person or service?
Does each person have only the permissions needed for their role?
How is privileged access controlled and reviewed?
Is multifactor authentication required?
What changes when someone changes role?
How quickly is access removed when someone leaves or the relationship ends?

Access granted years ago can easily become access nobody remembers exists. Clear approval, review and removal processes help both parties understand what is expected.

3. ASSURANCE — How do we know controls work?

A procurement questionnaire can be useful. Evidence gives it substance. Depending on the risk, assurance might include:

Relevant certifications, including Cyber Essentials or Cyber Essentials Plus.
Independent security assessments and penetration testing.
Security policies, standards and access-review records.
Incident-response processes and escalation arrangements.
Backup, recovery and business continuity test results.
Independent audit reports and regular service reviews.

Check the scope, date and relevance of evidence to the service you are buying. Certification alone does not demonstrate that every service or recovery promise is covered.

If a supplier says it reviews access, ask how it demonstrates that. If it processes your information, understand where data is stored, who can access it and which subcontractors are involved. Agree the handling requirements relevant to the relationship.

4. INCIDENT — What must be reported, how quickly, and who leads the response?

Agree this before an incident. Ask:

Which suspected or confirmed events must be reported to us?
How quickly must notification occur, and what updates will follow?
Who contacts whom, including outside normal working hours?
Who leads the supplier’s response and our business response?
Who investigates and supplies evidence?
Can supplier access be disabled quickly and safely?
Who decides on customer communications and any required external reporting?
Can our organisation continue operating, and how will service be restored?

Align reporting arrangements with the contract and applicable obligations. A security incident is a poor time to discover that nobody knows who should call whom.

5. EXIT — How do we safely leave?

How will data be returned in a usable format?
How will copies be deleted, subject to agreed retention requirements?
Who removes accounts and privileged access, and how quickly?
Can another provider take over?
Is documentation sufficient for a safe transition?
Are there contractual or technical barriers to exit?

A good relationship includes a safe route out.

Five supplier questions covering impact, access, assurance, incident reporting and exit

Global teams need the same clear security principles

An Employer of Record, business process outsourcing (BPO) provider or other partner can help recruit and manage teams internationally. That can simplify expansion, reduce administration and give access to skills in new markets.

Build cyber resilience into that operating model from the outset:

Manage devices appropriately and agree who maintains them.
Approve access, protect remote connections and remove permissions promptly.
Train employees in handling company and customer information.
Understand where information is stored and accessed, and agree relevant data protection requirements.
Make security part of onboarding, role changes, offboarding and daily operations.

These practices support growth by reducing ambiguity. Apply them according to the service, access and information involved.

A contract is the beginning, not the end

One common mistake is assessing a supplier during procurement and filing the assessment away. Businesses change. New integrations appear. People gain privileges. Subcontractors change. Companies merge or are acquired.

A relationship assessed as low risk three years ago may now support a critical process and hold thousands of customer records. Use a lifecycle with RISK-BASED OVERSIGHT:

Assess: identify critical suppliers, dependencies and business risk.
Contract: define security expectations, reporting and responsibilities.
Connect: control access and information sharing.
Assure: review evidence and service performance.
Test: exercise incidents, continuity and recovery.
Change / exit: reassess material changes and remove access safely.

Set the frequency and depth of reviews according to risk, with additional review when the service, access, ownership or delivery chain changes. Focus effort on relationships that matter most.

The third-party risk lifecycle with ongoing risk-based oversight

Then test what you think will happen

Have we actually tested this?

A supplier may promise a four-hour recovery. Your contract may contain a carefully written notification clause. Your internal plan may name a replacement provider. Those promises need practical validation.

Customer service: the outsourced team loses access to its systems. Can customers still contact you?
Finance: the ERP provider suffers ransomware at month end. Can you invoice customers and pay suppliers?
Managed IT: administrator credentials may be compromised. Can you disable supplier access without disabling your own business?
Cloud service: a critical online platform is unavailable for 24 hours. Do employees know how to continue operating?
Recovery: the supplier says everything is backed up. Has anyone demonstrated that it can actually be restored?

A short tabletop exercise can expose gaps in decisions, contacts and responsibilities. Pair it with practical restore and recovery tests where appropriate. Confirm who acts, what evidence is available, how long manual workarounds last and whether recovery meets business needs.

Good outsourcing should make you stronger

Specialist partners can provide capability, technology, experience and scale that would be difficult or uneconomic to build internally. Cyber resilience supports those benefits when it forms part of service design and ongoing management.

The objective is to:

Understand important risks and dependencies.
Decide whether the remaining risk is acceptable.
Reduce risks and transfer elements where appropriate.
Monitor the relationship according to risk.
Prepare for disruption and retain decision-making capability.
Maintain clear ownership and accountability.

Strong relationships are built on clear responsibilities, sensible controls and good communication. When a supplier has a problem, your organisation still needs the ability to make decisions. “We outsourced it” will not explain how you managed the dependency.

How CareFront can help

CareFront can offer expertise, advice and services to help organisations understand their exposure and take proportionate action. Its cyber advisory capabilities include:

Cyber strategy, governance, policy and operating models.
Third-party cyber risk management and cyber maturity benchmarking.
Data classification and vulnerability management.
DNS assessment and offensive security testing.
Security architecture across networks, cloud, applications and collaboration.
Identity and privileged access advisory.
Cyber Essentials readiness and security awareness.
Security monitoring, detection strategy and independent reviews of outsourced security operations and managed detection services (SOC/MDR).
Incident-response readiness and executive cyber tabletop exercises.
Business continuity, disaster recovery documentation and backup and recovery advisory.

These capabilities span governance, identification, protection, detection, response and recovery. They help turn security expectations into workable service arrangements, rather than treating cyber risk as a single technology problem.

We should practise what we preach

If CareFront, or specialists engaged through CareFront, becomes part of your supply chain, we should also be subject to appropriate scrutiny. That includes proportionate consideration of:

Confidentiality, contracts and data protection obligations.
Conflicts of interest and professional standards.
Access controls and security expectations.
Appropriate insurance and due diligence.
Applicable regulatory or compliance requirements.
Clear roles, responsibilities, reporting and relationship management.

The requirements should reflect the engagement. CareFront should be prepared to explain its arrangements, provide relevant assurance and work within the practices agreed with the client. A trusted advisor should expect the same appropriate oversight it recommends to others.

Outsource the capability. Share the responsibility. Verify the controls. Prepare for disruption. Retain accountability for managing your risk.

Know what you depend on, what could go wrong and who owns the response. Build security into the relationship from the start, then keep checking it as the service evolves.

You can outsource the service. You can’t outsource responsibility for managing the cyber risk.

Find out more at carefront.co.uk.

You can outsource the service. You can’t outsource responsibility for managing the cyber risk.