--- title: "Infographic: Why Vendor Cybersecurity Is The Next Big Supply Chain Topic" description: The issue of vendor cybersecurity isn't new, but awareness of the risks involved has been growing steadily. Let's take a look at why supply chain cybersecurity is important and how businesses can best mitigate risks. image: https://blog.sourceintelligence.com/hubfs/Vendor%20Cybersecurity%20Infographic.png --- ![shape background](https://blog.sourceintelligence.com/hubfs/raw_assets/public/Sourceintelligence_April2024/images/headertop.png) [ChainPoint and Compliance Map are now part of Source Intelligence](https://blog.sourceintelligence.com/tag/news) - [Source Academy](https://academy.sourceintelligence.com/?_gl=1*1gjeg4j*_ga*MTEwNzA5MDU1MS4xNzEzMzI4MDE3*_ga_X53KHMS0FW*MTcxMzMyODAxNy4xLjEuMTcxMzMzMzAyMS40OC4wLjA.) - [Careers](https://www.sourceintelligence.com/careers) - [Events](https://www.sourceintelligence.com/events) - [Contact](https://www.sourceintelligence.com/contact) - Log in - [Source Intelligence login](https://app.sourceintelligence.com/portico/?_gl=1*1obc0zd*_ga*MTEwNzA5MDU1MS4xNzEzMzI4MDE3*_ga_X53KHMS0FW*MTcxMzMyODAxNy4xLjEuMTcxMzMzMzAyMS40OC4wLjA.#/) - [Q-STAR login](https://qstar.qtec.us/Login/UserLogin.aspx) - [Parts Plus login](https://www.totalpartsplus.com/pp/login.asp) - [CMM login](https://profile.totalpartsplus.com/#/login?_k=d8cn30) [![Sourceintelligence](https://blog.sourceintelligence.com/hs-fs/hubfs/raw_assets/public/Sourceintelligence_April2024/images/headerlogo.png?width=526&height=180&name=headerlogo.png "Sourceintelligence")](https://www.sourceintelligence.com/) - Who we are - [About us](https://www.sourceintelligence.com/about) - [Our difference](https://www.sourceintelligence.com/our-difference) - Our solutions - [**C-Map solutions**](https://www.sourceintelligence.com/solution-overview) - Product compliance - [Overview](https://www.sourceintelligence.com/our-solutions/product-compliance) - [Global REACH](https://www.sourceintelligence.com/solution/global-reach) - [Global RoHS](https://www.sourceintelligence.com/solution/global-rohs) - [EU MDR](https://www.sourceintelligence.com/solution/eu-mdr) - [EU POPs](https://www.sourceintelligence.com/solution/eu-pops) - [Global PFAS](https://www.sourceintelligence.com/solution/pfas) - [Prop 65](https://www.sourceintelligence.com/solution/prop-65) - [SCIP](https://www.sourceintelligence.com/solution/scip) - [TSCA](https://www.sourceintelligence.com/solution/tsca) - Responsible sourcing - [Overview](https://www.sourceintelligence.com/our-solutions/responsible-sourcing) - [Audit Management](https://www.sourceintelligence.com/solution/audit-management) - [Minerals Reporting & Due Diligence](https://www.sourceintelligence.com/solution/conflict-minerals) - [EUDR](https://www.sourceintelligence.com/solution/eudr) - [Human Rights](https://www.sourceintelligence.com/solution/human-rights) - Sustainability - [Overview](https://www.sourceintelligence.com/our-solutions/sustainability) - [EPR](https://www.sourceintelligence.com/solution/epr) - Component Obsolescence - [Overview](https://www.sourceintelligence.com/our-solutions/parts-obsolescence) - [Obsolescence Management](https://www.sourceintelligence.com/solution/obsolescence-management) - [**ChainPoint solutions**](https://www.sourceintelligence.com/chainpoint-solutions) - Our platform - [Software](https://www.sourceintelligence.com/software) - [Managed Services](https://www.sourceintelligence.com/managed-services) - [Integrations](https://www.sourceintelligence.com/integrations) - Industries we serve - [Aerospace & Defense](https://www.sourceintelligence.com/aerospace-defense) - [Electronics](https://www.sourceintelligence.com/electronics-manufacturing) - [Industrial Manufacturing](https://www.sourceintelligence.com/industrial-manufacturing) - [Medical Devices](https://www.sourceintelligence.com/medical-device-manufacturing) - [Retail & Consumer Packaged Goods](https://www.sourceintelligence.com/retail-consumer-packaged-goods) - [Standards & Sector Initiatives](https://www.sourceintelligence.com/chainpoint-solutions) - [Resource center](https://blog.sourceintelligence.com/) [Schedule a demo](https://www.sourceintelligence.com/schedule-a-demo) - Who we are - [About us](https://www.sourceintelligence.com/about) - [Our difference](https://www.sourceintelligence.com/our-difference) - Our solutions - [**Cmap solutions**](https://www.sourceintelligence.com/solution-overview) - Product compliance - [Overview](https://www.sourceintelligence.com/our-solutions/product-compliance) - [Global REACH](https://www.sourceintelligence.com/product-compliance/global-reach) - [Global RoHS](https://www.sourceintelligence.com/product-compliance/global-rohs) - [Prop 65](https://www.sourceintelligence.com/product-compliance/prop-65) - [TSCA](https://www.sourceintelligence.com/product-compliance/tsca) - [SCIP](https://www.sourceintelligence.com/product-compliance/scip) - [PFAS](https://www.sourceintelligence.com/product-compliance/pfas) - [MDR](https://www.sourceintelligence.com/product-compliance/eu-mdr) - [POPs](https://www.sourceintelligence.com/product-compliance/pops) - Responsible sourcing - [Overview](https://www.sourceintelligence.com/our-solutions/responsible-sourcing) - [Conflict minerals](https://www.sourceintelligence.com/responsible-sourcing/conflict-minerals) - [Human rights](https://www.sourceintelligence.com/responsible-sourcing/human-rights) - [Deforestation](https://www.sourceintelligence.com/responsible-sourcing/deforestation) - [Raw materials traceability](https://www.sourceintelligence.com/) - [Audit management](https://www.sourceintelligence.com/responsible-sourcing/audit-management) - Sustainability - [Overview](https://www.sourceintelligence.com/our-solutions/sustainability) - [EPR](https://www.sourceintelligence.com/sustainability/epr) - Parts obsolescence - [Overview](https://www.sourceintelligence.com/our-solutions/parts-obsolescence) - [Obsolescence management](https://www.sourceintelligence.com/parts-obsolescence/obsolescence-management) - [**ChainPoint solutions**](https://www.sourceintelligence.com/chainpoint-solutions) - Industries we serve - [Aerospace & Defense](https://www.sourceintelligence.com/aerospace-defense) - [Electronics](https://www.sourceintelligence.com/electronics-manufacturing) - [Industrial Manufacturing](https://www.sourceintelligence.com/industrial-manufacturing) - [Medical Devices](https://www.sourceintelligence.com/medical-device-manufacturing) - [Retail & Consumer Packaged Goods](https://www.sourceintelligence.com/retail-consumer-packaged-goods) - [Standards & Sector Initiatives](https://www.sourceintelligence.com/chainpoint-solutions) - [Resource center](https://blog.sourceintelligence.com) - [Careers](https://www.sourceintelligence.com/careers) - [Contact](https://www.sourceintelligence.com/contact) - [Source Academy](https://academy.sourceintelligence.com) - Log in - [Source Intelligence login](https://app.sourceintelligence.com/portico) - [Q-STAR login](https://qstar.qtec.us/Login/UserLogin.aspx) - [CMM login](https://profile.totalpartsplus.com/#/login) - [Parts Plus login](https://www.totalpartsplus.com/pp/login.asp) [Schedule a demo](https://www.sourceintelligence.com/schedule-a-demo) ![](https://blog.sourceintelligence.com/hubfs/Vendor%20Cybersecurity%20Infographic.png) # Infographic: Why Vendor Cybersecurity Is The Next Big Supply Chain Topic Published by [Source Intelligence](https://blog.sourceintelligence.com/author/source-intelligence) on January 12, 2021 at 5:52 PM The issue of vendor cybersecurity isn't new, but awareness of the risk involved has been growing steadily. Let's take a look at why supply chain cybersecurity is important and how businesses can best mitigate risks.   ![Vendor Cybersecurity is the next big Supply Chain topic Infographic](https://blog.sourceintelligence.com/hs-fs/hubfs/Vendor%20Cybersecurity%20Supply%20Chains%20Infographic.png?width=600&name=Vendor%20Cybersecurity%20Supply%20Chains%20Infographic.png) ## The Issue of Vendor Cybersecurity   70% of all businesses are vastly under-protected when it comes to vendor and supply chain cybersecurity and don't include it in their risk management strategies according to a [report by Compliance Week](https://www.complianceweek.com/third-party-risk/drowning-in-third-party-risk-let-us-throw-you-a-life-jacket/28132.article). This leaves many companies vulnerable to cyber attacks, particularly through their third parties and suppliers. According to [FR Secure](https://frsecure.com/blog/15-eye-opening-vendor-risk-statistics/), 63% of all cyberattacks can be traced to third parties, and 87% of companies have experienced a disruptive incident with a vendor in the last 2-3 years.  Much of vendor cybersecurity risks stem from a lack of transparency. [Optiv reported](https://www.optiv.com/sites/default/files/2018-05/Third-Party_Risk_Capabilities_Brief.pdf) that 74% of companies aren't aware of every third party that has access to or handles their private data. In addition, many companies aren't aware of how many vendors are accessing their networks, which on [average is 89 per week](https://www.beyondtrust.com/).     ### The Data Security Landscape   Physical disruption, customer privacy, and intellectual property security is all interlinked. For a successful risk management strategy, supply chain, information technology, and operational technology must be taken into consideration. Many companies focus only on one or two, which leaves the entire structure vulnerable.  When it comes to vendor cyber attacks, some of the common threat actors include: - Hackers - Hacktivists - Employees - Supplier personnel - Criminal groups - Terrorists - Nation states - Competitors - Counterfeiters Some of the common threat methods include: - Phishing - Malware - Spear phishing - Ransomware - Tainted components - Denial of service - Firmware - Bogus devices - Viruses It's crucial to make a plan of action to prevent against all these common actors and methods.    ## Are There Vendor Cybersecurity Regulations?   In addition to the [California Consumer Privacy Act](https://oag.ca.gov/privacy/ccpa) and [GDPR](https://gdpr-info.eu/), the [Cybersecurity Maturity Model Certification](https://blog.sourceintelligence.com/supply-chain-cybersecurity-cmmc) (CMMC) is a new regulation for data protection. The CMMC’s goal is to assess the maturity of a company’s implementation of cybersecurity controls as well as the company’s maturity/institutionalization of cybersecurity practices and processes. There are also voluntary frameworks to comply with to strengthen your vendor cybersecurity such as the [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework).   ## How Source Intelligence Can Help   We give businesses the data and resources you need to ensure your supply chain is compliant with all current cybersecurity regulations and frameworks. Our AI-powered [Supply Chain Cybersecurity Program](https://www.sourceintelligence.com/supply-chain-cybersecurity) conducts assessments of both your internal and supplier security measures, gathers supplier data and documentation, flags areas of risk, and provides business intelligence. Request a demo to see how our cybersecurity program can strengthen your supply chain risk management. [![Request a Demo](https://no-cache.hubspot.com/cta/default/3926079/65572756-6694-44fc-8b43-80a25dbd0477.png)](https://cta-redirect.hubspot.com/cta/redirect/3926079/65572756-6694-44fc-8b43-80a25dbd0477) ### About the author #### Source Intelligence ![Source Intelligence](https://blog.sourceintelligence.com/hs-fs/hubfs/Icon_Logo%20(1).png?width=165&height=182&name=Icon_Logo%20(1).png) [Source Intelligence](https://www.linkedin.com/company/source-intelligence) is a leading provider of supply chain compliance software. It helps global manufacturers manage product compliance, responsible sourcing, and risk across complex supply chains. Its AI-powered, configurable SaaS platform connects supplier, product, and regulatory data to identify risk at the product, component, and material level. This delivers precise, defensible insights that support faster, more confident compliance decisions.   --- [Back to Blog](https://blog.sourceintelligence.com) ## Related Articles ## [Why Supply Chain Cybersecurity Is More Important Now Than Ever](https://blog.sourceintelligence.com/supply-chain-cybersecurity-cmmc) With the new California Consumer Privacy Act coming into effect, companies are once again taking... [Read More](https://blog.sourceintelligence.com/supply-chain-cybersecurity-cmmc) ## [Human Rights Laws Shaping Responsible Supply Chains](https://blog.sourceintelligence.com/human-rights-laws-shaping-responsible-supply-chains) Human rights regulations are essential for protecting vulnerable populations worldwide, shaping... [Read More](https://blog.sourceintelligence.com/human-rights-laws-shaping-responsible-supply-chains) ## [The Key to Eliminating Modern Day Slavery From Your Supply Chain](https://blog.sourceintelligence.com/blog/key-eliminating-modern-day-slavery-supply-chain) Modern day slavery, including forced labor, child labor, bonded labor, and other types of unethical... [Read More](https://blog.sourceintelligence.com/blog/key-eliminating-modern-day-slavery-supply-chain) [![Sourceintelligence](https://blog.sourceintelligence.com/hs-fs/hubfs/raw_assets/public/Sourceintelligence_April2024/images/footerlogo.jpg?width=526&height=180&name=footerlogo.jpg "Sourceintelligence")](https://www.sourceintelligence.com/) [![linkedin](https://blog.sourceintelligence.com/hubfs/Sourceintelligence_April2024/Images/linkedin.svg)](https://www.linkedin.com/company/source-intelligence/)[![Facebook](https://blog.sourceintelligence.com/hubfs/Sourceintelligence_April2024/Images/634031940f60200db6b16855_Facebook.svg)](https://www.facebook.com/sourceintelligence/)[![twitter](https://blog.sourceintelligence.com/hubfs/Sourceintelligence_April2024/Images/twitter.svg)](https://twitter.com/SourceIntel?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor)[![instagram](https://blog.sourceintelligence.com/hubfs/Sourceintelligence_April2024/Images/instagram.svg)](https://www.instagram.com/source.intelligence/) - Who we are - [About us](https://www.sourceintelligence.com/about) - [Our difference](https://www.sourceintelligence.com/our-difference) - [Take the assessment](https://source-intelligence.webflow.io/our-difference) - Our solutions - [C-Map solutions](https://www.sourceintelligence.com/solution-overview) - [ChainPoint solutions](https://www.sourceintelligence.com/chainpoint-solutions) - Contact - [Schedule a demo](https://www.sourceintelligence.com/schedule-a-demo) - [Contact us](https://www.sourceintelligence.com/contact) - [Careers](https://www.sourceintelligence.com/careers) - - [Terms of Use](https://www.sourceintelligence.com/terms-of-use) - [Privacy Policy](https://www.sourceintelligence.com/privacy-policy) - [DMCA Policy](https://www.sourceintelligence.com/dmca-policy) - [Accessibility](https://www.sourceintelligence.com/accessibility) - - [Resource center](https://blog.sourceintelligence.com/?_gl=1*1u87auu*_ga*OTI5NzExNzMuMTcxMzMyNzY1OQ..*_ga_X53KHMS0FW*MTcxMzUyMzY1NS4zLjAuMTcxMzUyMzY1NS42MC4wLjA.) - [IPC Generator Tool](https://www.totalpartsplus.com/ipcgenerator) - [Subscribe to Newsletter](https://compliance.sourceintelligence.com/quarterly-newsletter-subscription?_gl=1*yd43gy*_ga*OTI5NzExNzMuMTcxMzMyNzY1OQ..*_ga_X53KHMS0FW*MTcxMzUyMzY1NS4zLjAuMTcxMzUyMzY1NS42MC4wLjA.) - [Source Academy](https://academy.sourceintelligence.com/) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Organization", "name" : "Source Intelligence" }, "dateModified" : "2021-01-12", "datePublished" : "2021-01-12", "description" : "The issue of vendor cybersecurity isn't new, but awareness of the risks involved has been growing steadily. Let's take a look at why supply chain cybersecurity is important and how businesses can best mitigate risks.", "headline" : "Infographic: Why Vendor Cybersecurity Is The Next Big Supply Chain Topic", "image" : "https://compliance.sourceintelligence.com/hubfs/Vendor%20Cybersecurity%20Infographic.png", "mainEntityOfPage" : { "@id" : "https://google.com/article", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "height" : "60", "url" : "https://lh3.googleusercontent.com/pw/ACtC-3c6s2pLmxmhaZAAWHt-OQhUayTAlh_KH6Txfap5X5zclmm6n1cHbi0Uetj4GbvLjODFcpbsxT10gyOUEIYbALn2Tfx-wZe41w_vJk4WVSfWTS2vQf61VQbtFzjk3HK5WTVGC8HiCUw0QuFb1bjkz0go=w2343-h905-no", "width" : "60" }, "name" : "Source Intelligence" }, "url" : "https://learningcenter.sourceintelligence.com/infographic-vendor-cybersecurity" } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "70% of all businesses are vastly under-protected when it comes to vendor and supply chain cybersecurity and don't include it in their risk management strategies according to a report by Compliance Week. This leaves many companies vulnerable to cyber attacks, particularly through their third parties and suppliers. According to FR Secure, 63% of all cyberattacks can be traced to third parties, and 87% of companies have experienced a disruptive incident with a vendor in the last 2-3 years. " }, "name" : "Are vendor cybersecurity threats common?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Much of vendor cybersecurity risks stem from a lack of transparency. Optiv reported that 74% of companies aren't aware of every third party that has access to or handles their private data. In addition, many companies aren't aware of how many vendors are accessing their networks, which on average is 89 per week. " }, "name" : "What causes vendor cyber threats?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Physical disruption, customer privacy, and intellectual property security is all interlinked. For a successful risk management strategy, supply chain, information technology, and operational technology must be taken into consideration. Many companies focus only on one or two, which leaves the entire structure vulnerable. " }, "name" : "How can you prevent cyber attacks from your supply chain?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "In addition to the California Consumer Privacy Act and GDPR, the Cybersecurity Maturity Model Certification (CMMC) is a new regulation for data protection. There are also voluntary frameworks to comply with to strengthen your vendor cybersecurity such as the NIST Cybersecurity Framework." }, "name" : "Are there vendor cybersecurity regulations businesses have to comply with?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The CMMC's goal is to assess the maturity of a company's implementation of cybersecurity controls as well as the company's maturity/institutionalization of cybersecurity practices and processes." }, "name" : "What is the Cybersecurity Maturity Model (CMMC)?" } ] } ```