It's important to keep an eye on your supply chain partners to make sure their IT governance practices are up to snuff. Periodically reviewing their policies and procedures helps validate that they align with industry standards and your own service and contract requirements. Think of it like checking in on a distant relative - you want to make sure they're doing okay and haven't gone off the rails!

Where did this come from?

This sage advice comes straight from the CSA Cloud Controls Matrix v4.0.10 - 2023-09-26. You can download the full matrix of cloud security goodness at https://cloudsecurityalliance.org/artifacts/cloud-controls-matrix-v4. The matrix was inspired by the need for a comprehensive set of baseline controls to help organizations assess cloud computing risk. For more juicy details, check out the CSA website.

Who should care?

• Chief Information Security Officers (CISOs) who are responsible for managing risk across their organization's supply chain
• Vendor management professionals tasked with assessing the security of third-party suppliers
• Legal counsel who need to ensure contracts include the right to conduct supply chain governance reviews
• IT auditors looking to validate that supply chain risk management processes are operating effectively

What is the risk?

Without regular reviews of supply chain partners' IT governance:

• Suppliers may fall out of compliance with industry standards, introducing vulnerabilities into your ecosystem
• Partners could violate service level agreements or contract terms, impacting the quality and reliability of your operations
• Insider threats or external attacks at a supplier may go unnoticed, providing a backdoor into your own environment
• Reputational damage may occur if a supplier experiences a major security incident

While a governance review won't eliminate these risks entirely, it provides a mechanism to identify and mitigate issues before they spiral out of control. The earlier you catch a problem, the easier it is to contain.

What's the care factor?

For organizations with a large or complex supply chain, the care factor for this control should be high. A single weak link in the chain can bring the whole operation crashing down. Even for smaller entities, conducting supply chain governance reviews is a critical part of third-party risk management.

However, the level of effort and frequency of reviews should be commensurate with the criticality of the supplier and the sensitivity of the data or systems they handle. Not every partner needs an exhaustive annual audit. Be smart and prioritize your efforts.

When is it relevant?

Supply chain governance reviews are most relevant when:

• Onboarding a new supplier that will have access to sensitive data or systems
• Renewing contracts with existing high-risk vendors
• Responding to major changes in a supplier's business (e.g. merger, acquisition, executive turnover)
• Conducting regular risk assessments across your vendor portfolio

Reviews may be less critical for low-risk commodity suppliers or one-time engagements with limited scope. Again, it's all about managing to risk.

What are the trade-offs?

Conducting supply chain governance reviews requires time, effort and expertise. Depending on the depth of the assessment, it may necessitate pulling resources away from other security initiatives. Suppliers may also push back on burdensome review processes, straining partner relationships.

Organizations must weigh the benefits of increased visibility and assurance against these costs. Automation and standardized assessment frameworks can help streamline the process.

How to make it happen?

1. Define the scope of your supply chain governance review program

• Identify key risk factors (e.g. data sensitivity, business criticality, geography)
• Determine which suppliers will be in-scope based on pre-defined criteria

2. Establish a standardized governance review framework

• Leverage existing industry standards and best practices (e.g. ISO 27001, NIST CSF)
• Tailor controls to your specific business context and risk tolerance

3. Integrate governance review requirements into contracts

• Work with legal to define right-to-audit clauses
• Specify expectations for compliance with your governance framework

4. Conduct reviews at an appropriate frequency based on risk

• Perform a mix of self-assessments and on-site audits
• Collect evidence to validate control effectiveness

5. Establish a process to track and remediate issues

• Assign ownership and deadlines for corrective actions
• Escalate to leadership if necessary

6. Report on program metrics to demonstrate risk reduction

• Aggregate compliance data across the supply chain
• Highlight improvements over time

What are some gotchas?

• Suppliers may not have the same level of security maturity, requiring extra guidance
• Assessment fatigue can set in if governance reviews are too frequent or demanding
• Findings may uncover systemic issues that are difficult or costly to address
• Resource constraints can lead to cutting corners or postponing lower risk reviews
• Contract negotiations can drag on if suppliers reject right-to-audit clauses

What are the alternatives?

While a robust supply chain governance review program is ideal, resource-constrained organizations can still reduce third-party risk by:

• Implementing a supplier security questionnaire as part of procurement
• Leveraging security ratings services to monitor supplier health
• Including security requirements in contracts and service level agreements
• Conducting targeted penetration testing on high-risk vendor connections
• Participating in threat intelligence sharing communities to identify common supplier compromises

Explore further

• CSA Supply Chain Guidance Material (https://cloudsecurityalliance.org/research/supply-chain/)
• CIS Control 15: Service Provider Management (https://www.cisecurity.org/controls/cis-controls-list)
• NIST 800-161 Supply Chain Risk Management Practices (https://csrc.nist.gov/publications/detail/sp/800-161/final)

‍