What are supply chain risks?
Supply chain risks in cybersecurity are the risks that arise because an organisation depends on external parties, such as hardware and software suppliers, IT service providers, system integrators and manufacturers of OT equipment, so that a vulnerability or attack at any one of those links carries through into its own systems. The attacker then does not need to break through your own defences: they abuse the trust you already place in a supplier, for example through an update, a maintenance connection or a component buried deep in the firmware. In OT environments this weighs even more heavily, because installations last twenty years or longer and remain dependent on the same manufacturer throughout.
🧠 How does a supply chain risk arise?
A modern installation consists of products and services from dozens of parties, which in turn rely on sub-suppliers and open-source components. Each link can become a risk in three ways:
- Vulnerability - a flaw in a shared component, such as a TCP/IP stack or library, that sits in many products at once
- Compromise - an attacker breaks into the supplier and uses its channels to push malicious code to customers
- Dependency - the supplier disappears, ends support or is under the influence of a foreign government; see high-risk suppliers
In a July 2021 report the EU cybersecurity agency ENISA analysed 24 supply chain attacks from the preceding eighteen months. In 66 per cent of cases the attacker targeted the supplier’s code, and in 62 per cent they exploited the customer’s trust in that supplier. The Verizon Data Breach Investigations Report 2025 found that the share of breaches involving a third party had doubled from roughly 15 to 30 per cent.
| Risk | Example |
|---|---|
| Vulnerable third-party software | Vulnerability in PLC firmware or an embedded network stack from a supplier |
| Managed service is attacked | VPN provider, management platform or cloud service is targeted by ransomware |
| Hardcoded backdoor in equipment | OT equipment with hidden or fixed access for maintenance purposes |
| Infiltration via partner network | Supplier gains access to your OT network without segmentation |
| Manipulated update | Official, digitally signed update contains malicious code |
| Delivery of counterfeit hardware | Counterfeit components with deviating firmware or a hidden communication module |
📜 Which well-known attacks ran through the supply chain?
| Attack | Year | Route | Lesson for OT |
|---|---|---|---|
| Havex (Dragonfly) | 2013–2014 | Installers on the websites of eWON, MB Connect Line and Mesa Imaging replaced with trojanised versions | Software from a trusted ICS vendor must be checked before you install it |
| NotPetya | 2017 | Update of the Ukrainian accounting software M.E.Doc | Maersk’s IT systems and port terminals went down; the company put the damage at 200 to 300 million dollars |
| SolarWinds (SUNBURST) | 2020 | Manipulated Orion updates distributed between March and June 2020 | A signed update is no guarantee of trustworthiness |
| Ripple20 | 2020 | 19 vulnerabilities in the Treck TCP/IP stack, embedded in products from Schneider Electric and Rockwell, among others | Without an SBOM you do not know which devices contain a vulnerable component |
| Kaseya VSA | 2021 | REvil exploited a zero-day in IT service providers’ management software on 2 July | An attack on one supplier hit 800 to 1,500 businesses further down the chain |
| 3CX | 2023 | A trojanised X_TRADER installer led to a manipulated 3CX app | First known double supply chain attack; victims included the energy sector |
| XZ Utils | 2024 | Backdoor in versions 5.6.0 and 5.6.1 of an open-source library (CVE-2024-3094) | Open source in embedded systems belongs in your risk analysis |
Around 18,000 SolarWinds customers downloaded the infected update, although the company later estimated that fewer than 100 were actually hacked. The vulnerabilities in Kaseya VSA had already been reported in April 2021 by the Dutch Institute for Vulnerability Disclosure (DIVD); the attack happened before all of them had been fixed.
🏭 Where do supply chain risks sit in an OT environment?
In OT, suppliers are often physically and digitally interwoven with the process. Typical links are:
- Products - PLCs, SCADA software, historian databases, HMIs and engineering tools from external manufacturers
- Components - protocol stacks, operating systems and open-source libraries in embedded systems, often unknown to the end user
- Services - system integrators and maintenance contractors working in the production network via remote access or a laptop on site
- Updates - firmware and patches arriving through the supplier’s download portal or cloud platform
- Cloud - monitoring or control platforms that the supplier manages outside your network
The difference from IT is lifetime. A DCS or PLC often runs for two decades, while a supplier may stop issuing updates after a takeover or bankruptcy. A supply chain risk then becomes a lasting business risk.
⚖️ Which laws and standards require supply chain security?
| Framework | What it requires | Applies to |
|---|---|---|
| NIS2 Article 21 | Supply chain security, including relationships with direct suppliers; taking account of their vulnerabilities, product quality and secure development procedures | Essential and important entities |
| Cybersecurity Act and Cybersecurity Decree | Dutch implementation of NIS2 (Cyberbeveiligingswet), in force since 15 August 2026; Article 10 of the Decree covers supply chain policy | Dutch NIS2 entities |
| Cyber Resilience Act | Secure development, vulnerability handling, updates and an SBOM covering at least the top-level dependencies; reporting from 11 September 2026, full application from 11 December 2027 | Manufacturers of products with digital elements |
| ISO 27001:2022 | Annex A controls 5.19 to 5.23 for supplier relationships, the ICT supply chain and cloud services, selected on the basis of the risk assessment | Certified organisations |
| ISO 27036 | Guidance on information security in supplier relationships | Buyers and suppliers |
| IEC 62443-2-4 | Security programme for integrators and maintenance providers (edition 2.0, December 2023) | Service providers in industrial automation |
| IEC 62443-4-1 | Secure product development lifecycle | Manufacturers of OT components |
NIS2 and the CRA complement each other: a drinking water company must assess its suppliers under the Dutch Cybersecurity Act, while the manufacturer of its PLCs must deliver secure products under the CRA. In addition, Article 22 of NIS2 allows the EU to carry out coordinated risk assessments of critical supply chains, whose results entities must take into account. In the United States, NIST SP 800-161 Rev. 1 from May 2022 sets out a complete framework for cybersecurity supply chain risk management (C-SCRM).
🧭 How do you reduce supply chain risk step by step?
- Map suppliers and components - link your asset inventory to suppliers, sub-suppliers, firmware versions and access routes.
- Classify by criticality - which supplier could halt the process or affect safety if it failed or was compromised? Start there.
- Assess up front - ask for certifications such as ISO 27001 or IEC 62443-4-1, a vulnerability disclosure policy, the support period and an SBOM.
- Put it in contracts - security requirements, notification of incidents and vulnerabilities, audit rights, requirements from IEC 62443-2-4 and an exit arrangement.
- Restrict access technically - network segmentation following the zones and conduits model, remote access only through a Jump Server or managed VPN with MFA, time-limited and logged.
- Check what comes in - verify hashes and signatures with firmware signing, test updates in a test environment first and follow your patch management process.
- Monitor and review - track supplier activity with monitoring and reassess critical suppliers at least annually or after an incident.
Together these steps form the core of supplier security and third party risk management. A practical starting point for a mid-sized manufacturer is often the list of parties with remote access: it is usually shorter than expected, but almost always contains a forgotten permanent connection.
❓ Frequently asked questions
What is the difference between a supply chain risk and a supply chain attack?
A supply chain risk is the chance that a weakness at a supplier harms your organisation, even without malicious intent, for example through a vulnerable component or a supplier going bankrupt. A supply chain attack is a deliberate attack carried out through a supplier, such as the manipulated SolarWinds updates. Every supply chain attack is therefore a realised supply chain risk, but not the other way round.
Does my organisation have to assess its suppliers under NIS2?
Yes, essential and important entities under NIS2 must address the security of their supply chain, including relationships with direct suppliers. In the Netherlands, Article 10 of the Cybersecurity Decree (Cyberbeveiligingsbesluit) elaborates this as a policy on supplier dependencies with periodic checks. Suppliers that are not themselves in scope usually receive these requirements through contracts.
Does an SBOM help against supply chain risks?
An SBOM reduces supply chain risk by showing which software components a product contains, so that when a new flaw such as Ripple20 or XZ Utils emerges you quickly know which systems are affected. An SBOM does not prevent an attack, but it shortens the time between disclosure and response. Under the Cyber Resilience Act manufacturers must draw up an SBOM, although they do not have to publish it.
Are signed updates safe?
A digital signature proves that an update comes from the supplier and was not altered in transit, but not that its contents are trustworthy. In the SolarWinds and 3CX cases the malicious code was signed because the attacker was already inside the supplier. Test updates in a separate environment first and watch for unusual network traffic after installation.
Why are supply chain risks greater in OT than in IT?
Supply chain risks weigh more heavily in OT because installations remain dependent on one manufacturer for decades and replacement is costly and disruptive. Suppliers also often have remote access to the production network for maintenance. A compromised link can therefore affect not only data but also physical processes and safety.
Where should I start with managing supply chain risk?
Start with an overview of every supplier that has access to your OT network or delivers software for critical systems, and rank them by impact. Then bring remote access under a controlled route and add security requirements to new contracts. This delivers quick results and matches what NIS2 and the Dutch Cybersecurity Act require.
📌 In summary
Supply chain risks arise wherever you rely on an external party: in products, components, updates, cloud platforms and maintenance connections. Attacks such as Havex, NotPetya, SolarWinds and 3CX show that it is precisely this trust that gets abused. NIS2, the Dutch Cybersecurity Act, the Cyber Resilience Act and IEC 62443 make supply chain security an obligation for both buyers and manufacturers.
Supply chain risks are cyber threats arising from dependence on third parties; you reduce them with a supplier inventory, firm contractual requirements, an SBOM, controlled updates, segmentation and monitoring.