Supply chain risk management is the discipline of knowing which third parties touch your data, how exposed each one makes you, and what you would do if one was breached. For an SME that means a vendor inventory, a classification of each supplier by risk, and the right questions before you hand over data.
The uncomfortable truth is that your data no longer sits in one place you control. It sits in your accounting platform, your CRM, your payroll provider, your email host and the dozen smaller SaaS apps your team signed up for. A breach at any one of them is your problem — and potentially your reportable obligation under the Privacy Act.
Why third-party risk is now a leading breach vector
For years the security conversation focused on hardening your own perimeter — firewalls, patching, multi-factor authentication. That work still matters, but attackers worked out something obvious: it is far easier to breach one supplier with weak controls and ride that access into hundreds of downstream businesses than to attack each one individually. So the breach rarely happens inside your four walls. It happens at a vendor — a software provider, an outsourced bookkeeper, a marketing platform — and your data is collateral. You did everything right with MFA and backups, and you still end up notifying customers because a supplier you trusted left a database exposed.
The Australian context makes this concrete. The last few years have seen a string of large supplier and service-provider breaches where the headline organisation was big, but the real damage fanned out across thousands of smaller businesses whose data was processed on their behalf. When a payroll outsourcer or a legal-services platform is breached, every business that fed it data is suddenly exposed — and most had no idea how much was sitting there, or how weak that supplier’s controls were. The lesson is blunt: your security posture is only as strong as the weakest supplier holding your data.
Doing vendor risk management without enterprise GRC
Large organisations run formal governance, risk and compliance (GRC) programmes with dedicated teams, risk registers and continuous monitoring. An SME has none of that and does not need it. What you need is a “lite” version that captures most of the value for a fraction of the effort — five habits.
1. Maintain a vendor inventory
You cannot manage risk you cannot see. List every external party that holds, processes or can access your data and systems. Most SMEs are surprised by how long this list is once they write it down — accounting software, CRM, payroll, Microsoft 365, file storage, e-signature tools, the booking system, the marketing platform, the backup provider, and every smaller app a team member signed up for on a credit card. That last category is the dangerous one, and it overlaps with the problem we cover in our piece on auditing SaaS sprawl and hidden apps. The inventory does not need to be sophisticated — a spreadsheet with the vendor name, what data they hold, who owns the relationship, and how critical they are will do. The discipline is keeping it current.
2. Classify by data sensitivity and criticality
Not every vendor deserves the same scrutiny. Sort your inventory along two axes: how sensitive is the data they hold, and how badly would it hurt if they went down or were breached? The handful of suppliers that hold sensitive personal data, payment information or your core operational systems are your tier-one vendors — they get real questions and contract scrutiny. The rest get a lighter touch. Trying to assess every supplier to the same depth is how SMEs give up on vendor risk entirely.
3. Ask key suppliers the right questions
For your tier-one suppliers, a short questionnaire does most of the work. You are not auditing them; you are checking they are not obviously negligent and getting answers on the record. The questions that matter:
- Certifications. Do they hold ISO 27001, SOC 2, IRAP or an equivalent? A current certification is not a guarantee, but it tells you an independent party has looked at their controls.
- MFA and access control. Is multi-factor authentication enforced on their systems and on the admin access to your data?
- Breach notification. Will they notify you, and how quickly, if they suffer an incident affecting your data? Get the timeframe in writing.
- Data location. Where is your data physically stored and processed? Onshore in Australia, or offshore in a jurisdiction with different privacy rules?
- Sub-processors. Who else do they hand your data to? A vendor’s own suppliers become your risk, and the chain is often longer than anyone admits.
If a supplier cannot or will not answer these, that is itself a finding. A vendor that bristles at basic security questions is telling you something about how they treat your data.
4. Bake security clauses into contracts
Verbal assurances are worthless when something goes wrong. Where you have negotiating room, get the important commitments into the contract or data-processing agreement: a defined breach-notification window, a requirement to maintain reasonable security controls, restrictions on where data is stored, limits on sub-processors, and an obligation to return or destroy your data when the relationship ends. For the suppliers you choose and pay, this is where your virtual CIO earns their keep — reading the agreement before you sign it.
5. Review annually
Vendor risk is not set-and-forget. Suppliers change ownership, move data offshore, or quietly degrade their security. Once a year, pull out the inventory, confirm the tier-one suppliers still hold the certifications they claimed, and remove the vendors you no longer use. The annual review is the single habit that keeps the whole exercise honest.
A Box Hill example
A professional services firm in Box Hill we work with came to us after a near-miss. One of their outsourced administrative suppliers had suffered a data incident, and the firm spent a frantic week trying to work out whether any client data was caught up in it — only to discover they had no record of what that supplier held or where it was stored. The answer turned out to be “not much,” but the panic was real.
We built them a vendor inventory from scratch, classified their suppliers, and sent the tier-one ones a short questionnaire. Two could not confirm MFA on their admin access; one was storing data offshore the firm did not know about. None of it was catastrophic, but all of it was the kind of thing you want to know before an incident, not during one.
The flip side: your customers are now assessing you
Here is the part SMEs often miss. While you assess your suppliers, your customers — especially the larger ones — are assessing you. Vendor questionnaires flow in both directions. If you supply a listed company, a government department or any sizeable organisation, expect their procurement team to send you the same questions you should be asking your own vendors: what certifications do you hold, is MFA enforced, where is data stored, how fast will you notify us of a breach.
This is where demonstrating a recognised baseline pays off commercially, not just defensively. Holding Essential Eight alignment, an SMB1001 certification, ISO 27001 or SOC 2 turns a painful back-and-forth into a single document you hand over. We cover the SME-focused option in our guide to Essential Eight compliance for Melbourne businesses, and our cyber insurance guide for Australian SMEs shows how these credentials connect. The business that can answer the questionnaire quickly wins the work over the one that cannot.
Offboarding vendors properly
The riskiest vendors are often the ones you stopped using but never properly disconnected. A trial app that still has an active OAuth grant into your Microsoft 365, a former bookkeeper whose login was never disabled, a marketing tool with a standing API token reading your customer list — these are live doors into your environment nobody is watching.
Offboarding a vendor means more than cancelling the subscription. Revoke their OAuth app permissions in Microsoft 365 or Google Workspace, disable any service accounts or API keys, confirm they have returned or destroyed your data per the contract, and remove any standing access your staff held to their platform. Reviewing those OAuth grants routinely surfaces forgotten third-party access no one remembers approving — our cyber security services include exactly this kind of access hygiene.
Frequently asked questions
What is the difference between supply chain risk and third-party risk?
Third-party risk is the risk introduced by any external party you deal with directly. Supply-chain risk is broader and includes the parties behind those parties — your vendor’s vendors, the sub-processors handling your data further down the chain. For a small business the practical work is the same: know who holds your data, and how exposed each link makes you.
Do we need expensive GRC software to do this?
No. For an SME a maintained spreadsheet, a sensible classification of suppliers by risk, a short questionnaire for the important ones and an annual review will deliver almost all the benefit. Dedicated third-party risk platforms are built for enterprises managing hundreds of vendors under regulatory mandate. Start with the discipline, not the tooling.
What do we do if a key supplier is breached?
Check your inventory to confirm what data the supplier held, contact them for confirmation of what was affected, and assess whether the incident triggers your obligations under the OAIC’s Notifiable Data Breaches scheme. If personal information you are responsible for was likely accessed and serious harm is likely, you may need to notify the OAIC and affected individuals — far easier when you already know what the supplier held.
Where to start
TechAssist is a Melbourne-based MSP, founded in 2014, with 13 Australian-employed engineers and a 24/7 NOC at Tecoma — no offshore helpdesk. We help SMEs get a grip on third-party risk without enterprise overhead: building the vendor inventory, classifying suppliers, drafting the questions, cleaning up forgotten OAuth access, and getting you ready to answer your own customers’ security questionnaires. If you do not have a vendor inventory, that is the place to start. Get in touch and we will scope it with you.
