Supply chain cyber security: your perimeter is now someone else's laptop

Supply chain cyber security is not a procurement form. For a UK regulated firm, your perimeter is no longer your network. It runs through every supplier that can reach your data or your important business services. The annual questionnaire tells you what a supplier said once, and that isn't assurance. Assurance comes from four things: tiering by impact, controls in the contract, continuous signals and rehearsed supplier-origin incidents. UK regulators and DORA already expect all four, so when your board or supervisor asks how exposed you are through your suppliers, the answer can't be a folder of questionnaires.

That's an unpopular view in firms where vendor review means a spreadsheet of scores. I spent four years on the buy side in financial services, deciding whether technology suppliers passed or failed security review. Here's why I hold it, the strongest argument against it, and what I'd do about it.

Why the questionnaire isn't assurance

The questionnaire earns its place. It's cheap, it scales across hundreds of suppliers, and it leaves an evidence trail. The NCSC accepts a self-assessment questionnaire as an aid to contracting, provided it matches the minimum security requirements you have set.

The trouble starts when the questionnaire becomes the whole programme. A questionnaire is a snapshot taken on the day it was signed. Suppliers change owners, move data, add sub-processors and give new staff admin access. The NCSC lists the failure plainly in its guidance on assessing supply chain management practice: firms that "worry about the initial contract, but take little/no interest in subsequent contract renewals" and so "fail to spot changes/problems that may have arisen".

The breach path has moved too. A supply chain attack doesn't need to break the supplier's own network. It can come through access: an account, an identity, an admin console that already reaches into the systems other people rely on. In the ICO's 2025 penalty against Advanced Computer Software Group, attackers got in "via a customer account that did not have multi-factor authentication". The ICO notes reports of disruption to services such as NHS 111. One account without MFA was the way into a supplier that other services relied on.

No questionnaire answer from last year would have told the buyers which accounts lacked MFA that week.

What the buyer's seat teaches

From the buy side, the question is never whether the form was filled in. It's whether this supplier can hurt an important business service, and whether you would know before your customers do. That's a question about impact and about change, and a questionnaire answers neither.

Mapping is a point in time. Impact tolerances, ICT dependencies and third parties move. The real test is whether the picture is being maintained and tested. Meanwhile, DORA-driven third-party demands, operational resilience and continuous assurance are landing on a function built for an annual audit cycle and a spreadsheet risk register. That mismatch is the real exposure.

The regulators have already moved past the questionnaire. They put the duty back on the firm:

• FCA. SYSC 8.1.6R says a firm that outsources critical or important functions "remains fully responsible for discharging all of its obligations under the regulatory system". SYSC 8.1.6-AR puts the same duty on common platform firms.
• PRA. In SS2/21, in its current version (effective since 31 December 2024), "Boards and senior management, in particular individuals performing SMFs, cannot outsource their responsibilities". The PRA wants governance over "all third party dependencies", including those that "support the provision of important business services". A March 2026 version takes effect on 18 March 2027 and reframes materiality around the "material third party arrangement", not only outsourcing.
• DORA. Article 28(1)(a) of Regulation (EU) 2022/2554 says financial entities "shall, at all times, remain fully responsible" for their obligations when they use ICT services. DORA has applied since 17 January 2025. It binds EU financial entities, and reaches UK firms through EU groups, EU clients and the contracts they sign.

Trust is a regulated firm's licence to operate. You can't hand that licence to a supplier and assume the supplier will look after it.

The strongest objection

"We're a small firm. Our critical suppliers are hyperscale cloud providers who won't negotiate a word of their contract. The questionnaire is all we can realistically do."

It's a fair objection, and half of it is right. You won't rewrite a hyperscaler's terms, and a small team can't run deep reviews of every supplier. But the rules already allow for that. SS2/21 says "non-significant" firms may meet certain expectations "in a proportionate manner". DORA builds in proportionality too. For contracts that support critical or important functions, Article 30(3) even includes "the right to agree on alternative assurance levels if other clients' rights are affected". Proportionality changes how much you do. It doesn't remove the need to know which suppliers matter, what you'd do if one failed, and how you'd get out.

Nor does the UK critical third parties regime do the job for you. Since 1 January 2025, the FCA, PRA and Bank of England can oversee providers that HM Treasury designates. The FCA is explicit that the new rules "do not change the responsibility financial firms have" for resilience and "for their management of third-party suppliers". Oversight of the provider is the regulator's job. Your dependency on it is still yours.

What to do about it

The NCSC's 12 supply chain principles are the practical baseline, in four stages: understand the risks, establish control, check your arrangements, and keep improving. Four moves put them to work:

1. Tier suppliers by impact, not spend. Start from your important business services and work back to every supplier that can disrupt one or reach its data. A cheap identity tool with admin access can matter more than your biggest contract. That tiering is also your view of critical or important functions under SYSC 8 and material outsourcing under SS2/21. The ISO 27001 supplier relationships control gives you the policy anchor.
2. Put the controls in the contract. For your top tier, the contract should cover audit and access rights, incident notification, subcontracting and sub-processor change, and exit. SYSC 8.1.9R expects a common platform firm to keep "its instruction and termination rights, its rights of information, and its right to inspections". For DORA-scope firms, Article 30 lists the key contractual provisions. Where a service supports a critical or important function, they include exit strategies with "a mandatory adequate transition period". Your lawyers own the wording. Your risk function owns the list. A supplier security policy keeps that list consistent.
3. Watch continuous signals between reviews. Track attestation expiry dates, material change notices, incident notices and the access your suppliers' accounts hold. No rule sets the cadence; I'd review that access at least quarterly. Give each signal an owner, a trigger and an action, so it runs as an engineered process rather than an annual scramble. The ISO 27001 control on monitoring supplier services and the one on the ICT supply chain describe what good looks like.
4. Rehearse the incident that starts at a supplier. Run a tabletop where your most critical supplier is compromised or simply stops. Who decides, who tells the regulator, and how do you switch to a substitute? SS2/21 expects exit plans to cover a stressed exit and to be "documented and tested as far as possible". A plan you've never run is a document, not a capability.

None of this needs new software. It needs decisions, written down, with a name and a date against each one.

The question to ask this week

If your most critical supplier lost control of an admin account tonight, how long would it take you to know? If the answer is "when they tell us", your perimeter belongs to them. For the wider regulatory picture your firm faces, start with GRC for financial services.