Supplier Security

What is Supplier Security?

Supplier security is the set of contractual, organisational and technical measures an organisation uses to control the security risks that arise when external suppliers, integrators and service providers deliver products to, have access to or carry out maintenance on its systems. In OT environments this mainly concerns parties that supply PLCs, SCADA software and network components, commission installations or resolve faults via remote access. Their accounts, laptops, updates and maintenance connections are part of your attack surface, even though you do not manage them yourself.

Supplier Security is essential because a weakness at a supplier can directly affect the production, safety and continuity of industrial installations.

🧠 Why is supplier security so important in OT?

A production site quickly works with dozens of external parties: the OEM of a machine, the system integrator of the control system, the supplier of the historian, an installer of building management systems and an IT service provider. Four characteristics make that dependency particularly sensitive in OT:

• Suppliers often have deep access - engineering rights on PLCs and DCSs, administrator accounts on servers and sometimes a permanent maintenance connection.
• External software and hardware may contain weaknesses - vulnerable firmware, default passwords or outdated protocol stacks arrive with the product.
• Remote access opens the door to attackers - stolen credentials of a maintenance contractor give an attacker the same way in as the supplier itself.
• Long service life - an installation often runs for twenty years or more with the same supplier, so a weak agreement has long-lasting effects.

The breach at the American retailer Target showed how this goes wrong. Attackers got in on 15 November 2013 using credentials stolen from Fazio Mechanical, an installer of refrigeration and air-conditioning systems. Because the network was insufficiently segmented, they reached the point-of-sale systems from that supplier environment and collected data from around 40 million payment cards. A supplier with limited rights thus became the entry point for one of the largest data breaches of that decade.

🔄 How does it differ from supply chain risk and TPRM?

The terms overlap, but each has its own focus:

Supplier security is therefore the operational core: the agreements, access rules and checks you actually apply per supplier.

🧭 What does the lifecycle of a supplier relationship look like?

Supplier security does not start when an account is created and does not end at handover. ISO 27036-2 describes the supplier relationship as a lifecycle of planning, selection, agreement, management and termination; IEC 62443-2-4 fills in those phases with concrete requirements for OT service providers:

🛡️ Which measures are part of supplier security?

1. Contractual arrangements

• Security requirements in the contract or SLA - specify which standards apply, for example IEC 62443-2-4 for integrators or ISO 27001 for IT service providers.
• Notification duty - the supplier reports incidents and vulnerabilities affecting your installation within an agreed period.
• Audit rights and documentation - the right to an audit and delivery of network drawings, account overviews and an SBOM.

2. Access management

• Least Privilege - access management based on minimal rights: a supplier only gets access to the systems it maintains and only with the rights it needs.
• Controlled remote access - via a jump server or managed remote access platform with MFA, logging and time limits; for critical systems also with session recording through PAM.
• On-site network access - port authentication with 802.1X and RADIUS, and ACLs that define which traffic a supplier laptop may send.

3. Supplier classification

• Overview - map which suppliers have access to OT, via which route and to which assets.
• Risk profile - determine the profile based on role, level of access, location (on site or remote) and the impact on process and safety.

4. Audits and monitoring

• Assessment - assess suppliers through an audit, certificates, assessment reports or questionnaires; questionnaires alone are not enough for critical suppliers.
• Monitoring - track supplier activity in your systems with SIEM and security monitoring.

5. Policy and procedures

• Anchoring - supplier security is part of the Information Security Policy.
• Procedures - clear request and approval steps for access and a fixed offboarding process for supplier accounts.
• Periodic review - check access rights and credentials regularly and replace shared passwords.

🏭 Which scenarios are common in OT?

🔐 Which standards and regulations apply to supplier security?

🔧 How do you set up supplier security step by step?

1. Create a supplier register - link each supplier to its assets in the asset inventory, its access routes and a contact person for incidents.
2. Classify - divide suppliers into three classes, for example high (access to control or safety systems), medium (access to servers or data) and low (no digital access).
3. Set minimum requirements per class - for the highest class, for example, personal accounts, MFA, access only after approval per session and incident notification within 24 hours, in line with the early warning under NIS2.
4. Include requirements in procurement and contracts - use IEC 62443-2-4 for services and, for products, ask for security features such as strong authentication, logging and secure default settings. The Secure by Demand guidance that CISA and partners published in January 2025 for buying OT products names the same points.
5. Centralise access - one route for remote access, segmented networks and no stand-alone modems or routers in the field.
6. Check and evaluate - reassess suppliers in the highest class at least annually and after every incident, and check every quarter whether active accounts still belong to running contracts.

A common starting point is a session with procurement, maintenance and IT: the list of parties with remote access is often shorter than expected, but almost always contains a forgotten connection.

❓ Frequently asked questions

Is supplier security mandatory under the Dutch Cybersecurity Act?

Yes, essential and important entities under the Dutch Cybersecurity Act (Cyberbeveiligingswet) must secure their supply chain. The Cybersecurity Decree requires a written policy and agreements with direct suppliers on cybersecurity for this purpose. For these organisations, supplier security is therefore a legal duty of care rather than an optional best practice.

Which standard should I use for requirements on an OT integrator?

For integrators and maintenance providers in OT, IEC 62443-2-4 is the standard written specifically for their security programme. It describes twelve functional areas, from staffing to backup, and four maturity levels on which a service provider is assessed. For requirements on the development process of a product supplier, you use IEC 62443-4-1.

Is a supplier’s ISO 27001 certificate enough?

An ISO 27001 certificate shows that a supplier has an information security management system, but says little about how it works in your OT network. Always check the scope of the certificate and supplement it with concrete agreements on access, patches and notifications. For OT service providers, an IEC 62443-2-4 certificate is often more specific.

How do I give a supplier secure remote access?

Secure remote access for a supplier runs through one central route, such as a jump server or managed remote access platform, with MFA and personal accounts. Sessions are approved individually, limited in time and logged or recorded. Stand-alone modems, 4G routers and permanent supplier VPN connections have no place in this setup.

What should happen when a supplier contract ends?

When a supplier contract ends, you revoke all accounts, certificates, VPN profiles and keys belonging to that supplier. Also change the passwords of shared system accounts the supplier knew and check that no connections or equipment are left behind. In addition, have the supplier hand over the current documentation and backups of the installation.

What is the difference between supplier security and third party risk management?

Supplier security focuses on concrete security measures around suppliers, such as contract requirements, access management and monitoring. Third party risk management is the broader process that assesses all risks from third parties, including financial, legal and operational risks. Supplier security is therefore the security component of third party risk management.

📌 In summary

Suppliers are indispensable in OT and sometimes have more access to your installation than your own staff. Supplier security makes that dependency manageable with a lifecycle of selection, contract, onboarding, oversight and termination, supported by IEC 62443-2-4, ISO 27036 and ISO 27001 and made mandatory by NIS2 and the Dutch Cybersecurity Act.

Supplier Security focuses on covering the risks that external suppliers bring into OT environments: with firm contract requirements, one controlled access route, minimal rights, monitoring and strict offboarding, you stay in control of who works on your installation.