Why vendors matter
Most businesses give vendors access to their systems: the IT provider, the accounting firm, the line-of-business software vendor. Each of these access points is a possible way in. An attack on one vendor can hit many customers at once.
Stricter requirements are coming
The NIS2 Directive puts heavy emphasis on supply chain security and on management's responsibility. For Norwegian businesses that already comply with the Norwegian Digital Security Act (digitalsikkerhetsloven), the transition is largely a matter of expanding the work in this area.
What you can do
Start by taking inventory: Which vendors have access, to what, and how? Then limit that access, log it, and remove it when it's no longer needed. Set requirements for your vendors' own security as well.
What we recommend
- Make a list of vendors with access to your systems
- Give vendors time-limited, logged access
- Include security requirements in your contracts
- Review vendor access at least once a year
How we can help
Wondering what this means for your organization? Let's talk.
Request a meeting →