Testing your suppliers: questions to ask

A weak supplier is a way into your organisation. You cannot test their systems without permission, but you can ask good questions.

Questions to ask

1. When was the last independent penetration test, and what was its scope?
2. Were the findings fixed and tested again? Can we see a summary?
3. How do you handle a vulnerability report, and how fast do you tell customers?
4. What access do your staff have to our data, and how is it controlled and logged?
5. Do you use multi-factor authentication for all administrative access?
6. Which of your own suppliers can reach our data?

How to read the answers

A short, specific answer is a good sign. A long general one, or a refusal to say anything, is information too.

Where testing fits

If a supplier's service is part of your system, ask for permission to include it in your test, or for their own report covering it.