Security in the supply chain
At Â鶹´«Ã½Ó³», security is at the heart of everything we do, and this is reflected in the management of our Supply Chain. An aspect of this is ensuring that all Â鶹´«Ã½Ó³» suppliers maintain suitable Security controls.
Security controls can look very different between suppliers; but as a supplier, having appropriate security controls for your business not only benefits your business (by reducing the risk of an incident, which is not only costly but also damaging to a company’s reputation), but is also a responsibility of being a Â鶹´«Ã½Ó³» supplier.
Assign responsibility!
While all staff in a company have a responsibility for security, it is important to have an individual (or team) with overarching accountability for Security controls.
Implement a Management System!
An Information Security Management System (ISMS) provides the framework for Information Security Management throughout the business and defines the Information Security policies and processes the company operates to, as well as designating Security responsibilities to individuals within the company.
Get audited!
Being audited can sound scary, but an external assessment can be an extremely useful tool to ensure that the security controls you have in place are suitable for your business and are helping maintain its security.
Supplier Incident phone number:
(+44) 20 8963 7030
Sometimes, despite best efforts from all those involved, breaches and incidents still occur. If you experience an incident, it is important to notify Â鶹´«Ã½Ó³» of this as soon as possible, and within 72 hours, unless contractually agreed otherwise. This should be done by calling in on the dedicated Supplier Incident phone number.
You will be asked questions by the team at Â鶹´«Ã½Ó³» (such as name and contact details, contract(s) working on and details of the incident) to allow them to take appropriate steps internally to secure Â鶹´«Ã½Ó³» data.
This information allows Â鶹´«Ã½Ó³» to take any necessary steps to protect Â鶹´«Ã½Ó³» and Â鶹´«Ã½Ó³» Customer data. Where feasible, it is also possible that you will also be offered assistance with recovering from the incident.
After an incident
It is likely that you will be asked to participate in an audit conducted by a member of Â鶹´«Ã½Ó³» staff following an incident. This helps us to ensure that you have implemented sufficient Security Controls to mitigate the risk of any future incidents occurring, and that Â鶹´«Ã½Ó³» assets are duly protected.
Wherever possible, Â鶹´«Ã½Ó³» aim to keep suppliers onboarded after they have experienced an incident; however, there may be cases where a breach is considered too high a risk and continuation of the contract must be considered. You will be notified of any decisions surrounding this as soon as possible.
Additional resources
If you would like to learn more about strengthening your security posture, please check out the below links:
