Managing Supplier Access: Securing Your Supply Chain in Practice

Short answer: securing your supply chain in practice comes down to controlling what each supplier can reach. Give every supplier its own account, never a shared login. Switch remote access on when it’s needed and off when it isn’t. Protect every supplier account with multi-factor sign-in. And remove access the day a supplier relationship ends. Keep it all on one page, and you’ve done more than most small businesses ever do.

Asking suppliers the right questions is half the job. The other half is what those suppliers can actually get into, right now, today. The old IT company that still has a remote access tool installed. The software vendor with a shared admin password from the day it was set up. The web developer who still has a login to the website three years after the project ended.

Not sure who can still get into your systems? Ring 0151 452 3060 and a person picks up. Finding out is usually a morning’s work.

1. One supplier, one account

Shared logins are the most common supplier access problem in small businesses. If three suppliers and two members of staff all use the same “admin” account, you can’t tell who did what, you can’t remove one of them without changing it for everyone, and the password is probably written down in several places.

Give each supplier its own named account, with only the access it needs. For Microsoft 365, that usually means a guest or dedicated account rather than your own admin login. It’s a small change that makes everything else on this list possible.

2. Remote access: on when needed, off when not

Remote access tools are how IT providers and software vendors fix things without visiting. They’re also a favourite way in for attackers, because they give full control of a machine. Check which remote access tools are installed on your computers. You may find several, including ones from suppliers you no longer use.

The ones you keep should need approval or a code each time, should be protected with multi-factor sign-in, and should log every session. Anything from a former supplier should be removed.

3. Multi-factor sign-in on every supplier account

A supplier account without multi-factor sign-in is a password away from an attacker. DSIT’s 2025 survey found only 40% of businesses protect email with multi-factor authentication, and supplier accounts are often the ones that get missed because nobody in the business logs into them. Make it a condition: no multi-factor, no access.

Want every supplier account found and locked down? A cyber risk assessment covers accounts, admin rights and remote access, and gives you the list to fix. Ring 0151 452 3060.

4. Offboard suppliers like you offboard staff

When someone leaves, their access should end the same day. Suppliers deserve the same treatment, and they rarely get it. When a contract ends, work through a short checklist: disable their accounts, remove their remote access tool, change any passwords they knew, revoke any app permissions they were given, and get confirmation that they’ve deleted your data. The same logic applies to staff; see our guide to employee offboarding.

5. Keep a one-page supplier register

All of this is easier with one page that lists every supplier who can reach your data or systems. For each one, record:

• What they do for you, and who your contact is.
• What they can access: systems, data, money.
• How they access it: named account, remote tool, shared system.
• Whether multi-factor sign-in is on.
• When you last checked their security, and their answers.
• What happens to access and data when the contract ends.

Review it once a year. It’s also exactly what a client, insurer or Cyber Essentials assessor will want to see. For the questions to ask each supplier, see checking your suppliers. For the software you use, which is a supply chain of its own, see your software supply chain.

Start with remote access. It’s the quickest win and the biggest risk. Book fifteen minutes with Eric this week and we’ll tell you what to look for. Ring 0151 452 3060 and a person picks up.