Martyn Janes, lead cyber underwriter at rrelentless explains why vendor management should be high on a operation’s risk management strategy and insurance is a must.

Jaguar Land Rover (JLR)’s recent cyberattack, which disrupted production and rippled through its network of smaller suppliers, alongside the incident impacting Collins Aerospace, highlights the importance of vendor management in the risk management world. In the current cyber threat landscape, it’s not sufficient to select vendors purely based on functionality; careful consideration of their security is also necessary.

Without proper vetting, there is a serious risk of a cyber-attack cascading across different businesses, not just the direct target. However, the good news is that there are steps companies can take to strengthen vendor oversight and build resilience.

The JLR case

JLR’s factories have been shut for over a month following a cyberattack that forced it to shut down its computer systems. From October, the car manufacturer expects to resume some production; however, the severe impact on the supply chain has led to government intervention, with a £1.5bn loan being granted in an effort to protect skilled jobs. It is rumoured that JLR’s SAP software was exploited, which many businesses rely on, emphasising the connected nature of today’s systems and how one break can impact many.

Considerations for vendor management

There are a range of challenges and measures organisations need to be aware of to minimise cyber threats from third parties. These include:

• System integration risks: As illustrated in the JLR case, which led to smaller suppliers facing potential financial collapse, integration between customer and supplier systems can have knock-on effects across various industries. Businesses need to have plans in place in case key suppliers fail.
• Third-party due diligence: This is vitally important when assessing vendors and shouldn’t be an afterthought. When conducting due diligence, ask whether vendors are incorporating cybersecurity into their operations, how reliant the business is on these vendors, and whether contingency plans are in place in case issues arise.
• Contingency planning: Workarounds are absolutely critical for a business to not just recover, but also continue its operations. Organisations need to consider the options available to them in the event that a cyber-attack disrupts critical third-party services.

Cyber insurance is a must-have

As recent cases have shown, no one is immune, and it’s often small companies that are most vulnerable to disruption, making it critical for businesses of all sizes to invest in cyber insurance as a key business priority. The best policies will cover data breaches, as well as ransomware payment, business interruption, legal fees, and educational support.

It was rumoured that JLR was not insured, with the business estimated to be losing £50 million per week in lost production. While cyber insurance isn’t a silver bullet, it provides a safety net for indirect and direct financial losses, and can also support efforts such as external communication, technical support, and legal fees to remedy an attack as quickly as possible.

Beyond cyber insurance, a proactive approach will ensure holistic resilience is embedded across the organisation and its supply chain. For instance, educating internal teams on how the company uses third-party software and what to do if things go wrong. Likewise, ensure that incident response plans are in place for each vendor in the supply chain.

Ultimately, with a strategic and proactive approach, coupled with appropriate insurance cover, businesses can ensure they are prepared, resilient, and not exposed by a weak link in their supply chain.